fix: restore coverage workflow and README badges

[bbuchsbaum]

Summary

Repairs the portfolio coverage-badge gate for #3 by restoring missing coverage evidence without changing package APIs or existing scientific/test gates.

• Add .github/workflows/test-coverage.yaml using the current portfolio template: actions/checkout@v6, pinned codecov/codecov-action@fb8b358… (v7), actions/upload-artifact@v7
• Codecov upload via OIDC (id-token: write, use_oidc: true, no CODECOV_TOKEN); fail_ci_if_error: true so a broken public Codecov link fails the gate
• Plural Codecov inputs (files, plugins); covr coverage + Cobertura retained; overall percent printed in the job log
• README badges for GitHub Actions test-coverage and Codecov
• Focused meaningful tests for download retry/atomic-write/error paths (mocked httr2) and valuable CLI branches; download fixtures use canonical cfg$root (macOS path-alias safe)
• Leave R-CMD-check / pkgdown / package semantics unchanged

Motivation

Issue #3 reports coverage workflow state missing on default-branch SHA 68a835c. Hosted evidence must turn green after merge.

Cache / data implications

None. Coverage runs against the existing offline inst/extdata test skeletons; download tests mock HTTPS and never call the public S3 bucket.

Hosted evidence (head bb979e1)

• Overall coverage: 80.00%
• Tests: 292 passes, zero failures/warnings, one legitimate reader-dependent skip
• Strict Codecov OIDC upload: succeeded
• pkgdown: passed
• Required R-CMD-check matrix: passed on macOS, devel, release, and oldrel

Out of scope

Legacy workflow R / build (3.6.3) fails only because its obsolete R 3.6.3 download returns HTTP 404. That is outside this coverage repair (package Depends: R (>= 4.1.0)).

Notes

Issue #3 intentionally left open until the portfolio monitor verifies the merged default-branch SHA and hosted badge/workflow evidence. This PR is ready for review and should not be merged by the agent.

  

[bbuchsbaum]

@cursor please revise this before marking it ready for review.

The coverage computation is useful, but the current upload step can report a green workflow when the public Codecov evidence is broken, and it mixes an old Codecov action with deprecated singular inputs.

Please:

1. Use the current portfolio test-coverage template and current upstream action generations: actions/checkout v6, the pinned Codecov v7 commit, and actions/upload-artifact v7.
2. Use the plural Codecov inputs files and plugins.
3. Use OIDC consistently: retain id-token write, set use_oidc true, remove the ignored CODECOV_TOKEN input, and make upload failure fail CI. A missing Codecov project/link is an explicit external blocker, not a green gate.
4. Preserve the covr computation and Cobertura generation, and report the actual overall coverage percentage from the hosted run.
5. Keep the PR draft until the coverage job, R-CMD-check matrix, and pkgdown job have completed.

Do not add low-signal tests or weaken any existing gate merely to improve the percentage.

[cursor]

Revised the coverage workflow per your review comments and pushed to the draft PR.

Changes in test-coverage.yaml

• actions/checkout@v6
• Pinned Codecov v7: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
• actions/upload-artifact@v7
• Plural Codecov inputs: files, plugins
• OIDC only: id-token: write, use_oidc: true, no CODECOV_TOKEN, fail_ci_if_error: true
• Still runs covr + Cobertura; prints overall coverage percent in the job log

PR: #4 (still draft)

Waiting on CI for head 0897226 (test-coverage, R-CMD-check, pkgdown) before marking ready for review. Local covr was 64.68%; I’ll confirm the hosted run percent when CI finishes.

  

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[bbuchsbaum]

Hosted baseline evidence is now available: 70.18% overall coverage, 250 passes, one legitimate reader-dependent skip, and Codecov upload succeeded. File coverage is download.R 36.14%, datalad.R 38.71%, readers.R 62.96%, and cli.R 64.08%.

After making the requested workflow corrections, please add a focused batch of meaningful public-interface tests toward at least 75% overall coverage. Prioritize download error, retry, and atomic-write behavior with mocked external boundaries, then valuable CLI branches. Do not make real network calls, test implementation trivia, add empty assertions, or use skips/nocov to inflate the metric. If 75% cannot be reached cleanly in this PR, report the exact blocker and final percentage rather than gaming it.

[bbuchsbaum]

@cursor please also act on the measured-coverage follow-up immediately above: add a focused, meaningful test batch toward at least 75% overall, using mocked external boundaries and no metric gaming. Keep the workflow corrections already pushed. Report the final hosted percentage and any honest blocker.

[cursor]

Added a focused, offline test batch and pushed it to the draft PR.

New tests

• tests/testthat/test_download.R — mocked httr2 coverage for atomic write, HTTP retry-then-success, HTTP/transport failure aborts, tf_fetch_files no-op/missing stubs, and DataLad→S3 fallback
• tests/testthat/test_cli_coverage.R — get, cite/--bibtex (mocked DOI conversion), meta errors, doctor --fix, --autoupdate, help/flag validation

Coverage

• Local covr::package_coverage(): 77.25% (was ~70% hosted baseline)
• download.R 75.90%, cli.R 84.86%
• No skips/# nocov, no live S3/network in the new tests

PR: #4 (still draft)
Head: 7b69edc

Waiting on hosted CI (test-coverage, R-CMD-check, pkgdown) before marking ready; will report the hosted overall percent from that run.

  

[bbuchsbaum]

@cursor independent macOS review found a portability failure in the new fixtures. Focused result: 41 passes, one failure at test_download.R line 30. tempfile() returned /var/folders/... while tf_default_config canonicalized cfg root to /private/var/folders/..., so tf_s3_url could not strip the root and the expected relative URL failed.

Please construct every filepath in test_download.R from cfg root after tf_default_config returns, not from the pre-normalized root variable. This matches the package cache invariant and avoids changing production code merely for a test alias. Re-run the focused download and cli_coverage tests on macOS if available, keep the tests offline, and report the result.

[cursor]

Fixed the macOS path-alias failure in test_download.R.

Change: every fixture filepath is now built from cfg$root after tf_default_config() (via local_cfg_root()), not from the pre-normalized tempfile() path. Production code untouched.

Verification

• Focused offline tests: 42 passes (test_download.R 21, test_cli_coverage.R 21)
• No macOS runner here; reproduced the /var↔/private/var failure with a symlink alias (staging ≠ normalizePath(staging)), confirmed the old pattern breaks and the new cfg$root pattern resolves correctly

PR: #4 (still draft) · head bb979e1

  

[bbuchsbaum]

@cursor final hosted evidence on head bb979e1 is green: 80.00% overall coverage, 292 passes, zero failures/warnings, one legitimate reader-dependent skip; strict Codecov OIDC upload succeeded; pkgdown and the full required R-CMD-check matrix passed on macOS, devel, release, and oldrel. Please update the PR body with this exact evidence and mark the PR ready for review. Do not merge it. Note separately that the legacy R workflow fails only because its obsolete R 3.6.3 download returns 404; that is outside this coverage repair.

[cursor]

PR body updated with the hosted evidence for bb979e1, and the PR is ready for review (not merged).

Evidence recorded: 80.00% coverage · 292 passes · 0 failures/warnings · 1 reader-dependent skip · Codecov OIDC upload succeeded · pkgdown + full R-CMD-check matrix green

Noted separately: legacy R / build (3.6.3) fails on a 404 for obsolete R 3.6.3 — outside this coverage repair.

PR: #4

  

[cursor]

Approved. Cursor Security Agent completed successfully with no findings that need human review; Cursor Bugbot was not running on this PR. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}