From 7d5adbc1fabc6a3cf1711c28bc0aac7efddecd55 Mon Sep 17 00:00:00 2001
From: Dariusz L <dl122@wp.pl>
Date: Sun, 2 Aug 2026 20:15:06 +0200
Subject: [PATCH] ci: enforce workflow coverage gate

---
 .github/workflows/ci.yml | 17 ++++++++++++++---
 docs/architecture.md     |  8 +++++++-
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d20ae1a..9d8b763 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,7 +46,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.10"
           cache: pip
@@ -54,8 +54,19 @@ jobs:
       - name: Install Python dependencies
         run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
 
-      - name: Run Python tests
-        run: python -m pytest
+      - name: Run Python tests with workflow coverage
+        run: >-
+          python -m pytest -q --cov=core.workflow
+          --cov-report=term-missing
+          --cov-report=xml:coverage-workflow.xml
+          --cov-fail-under=75
+
+      - name: Upload workflow coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: workflow-coverage
+          path: coverage-workflow.xml
+          if-no-files-found: error
 
       - name: Run Ruff
         run: python -m ruff check __init__.py core
diff --git a/docs/architecture.md b/docs/architecture.md
index 47162e6..225e3ef 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -76,7 +76,13 @@ The workflow uses the tracked `package-lock.json` with `npm ci`, has read-only
 repository permissions, and does not require secrets. Its two jobs run:
 
 1. `npm test` and `npm run lint` for the frontend.
-2. `pytest`, Ruff, and `compileall` for the backend.
+2. The Python suite with branch coverage for `core.workflow`, Ruff, and
+   `compileall` for the backend.
+
+The backend job requires at least 75% coverage for `core.workflow` and uploads
+the XML report as the `workflow-coverage` artifact. The threshold is scoped to
+the refactored workflow package while the remaining legacy backends are being
+covered incrementally.
 
 The workflow uses `pull_request`, not `pull_request_target`, so code from an
 external fork is tested with the restricted pull-request token context.