Choizapp .github

Org-level community health files and shared GitHub Actions workflows.

Reusable workflow for backend Java/Maven repos. Replaces the Codecov upload step in CircleCI with a self-hosted reporter that:

• Runs mvn test and parses target/site/jacoco/jacoco.xml
• Posts a single sticky comment on the PR with overall + per-file + patch coverage
• Enforces a patch coverage threshold on changed Java lines (default 90%)
• Shows the project's overall coverage with a configurable target (informational) and an optional gating threshold (hard fail)

Why two-level gating: repos with historical coverage below the 90% lineamiento can adopt the workflow without blocking every PR. Patch coverage stays strict (new code must be tested), overall is shown as informational and rises naturally over time.

.github/workflows/coverage.yml in the consumer repo:

name: Coverage

on:
  pull_request:
    branches: [develop, master]

jobs:
  coverage:
    uses: Choizapp/.github/.github/workflows/backend-coverage.yml@v1

Defaults applied:

• threshold-patch: 90 — patch coverage gate (hard)
• threshold-overall: 0 — overall gate disabled (informational only)
• target-overall: 90 — informational target shown in the comment

name: Coverage

on:
  pull_request:
    branches: [develop, master]

jobs:
  coverage:
    uses: Choizapp/.github/.github/workflows/backend-coverage.yml@v1
    with:
      use-codeartifact: true

jobs:
  coverage:
    uses: Choizapp/.github/.github/workflows/backend-coverage.yml@v1
    with:
      threshold-patch: '85'
      threshold-overall: '85'
      target-overall: '90'

• jacoco-maven-plugin configured in pom.xml (prepare-agent + report)
• If pom.xml defines an explicit <argLine> inside maven-surefire-plugin, it must start with @{argLine} so JaCoCo's prepare-agent can inject its agent. Without this, the report is generated empty and the workflow has nothing to gate against.

Pin the caller to @v1 (or a more specific tag like @v1.3) to avoid surprises when the reusable workflow evolves. New backwards-compatible features go in a fresh tag (v1.4, v1.5, ...); breaking changes require a new major (@v2).

v* tags are protected via a repository ruleset — they cannot be deleted, force-pushed, or rewritten. To ship a fix, create a new tag and have consumers update their @v1.x pin. The @v1 pointer is therefore frozen at the current "stable" snapshot; bumping it requires temporarily lifting the ruleset.

This repo is public but contains only CI orchestration — no secrets, no proprietary code. Visibility implications:

• The AWS account ID and IAM role ARN are visible. Both are safe because the role's trust policy restricts assumption to repo:Choizapp/*:pull_request.
• The reusable workflow can be invoked from any repo in any org. Non-Choizapp callers will fail at the OIDC step (trust policy mismatch).
• Pushes to main require a PR; force-pushes and deletions are blocked. Tags matching v* are similarly protected.
• The shared script is checked out at the same commit SHA as the called workflow (github.job_workflow_sha), so script and workflow always travel together.

Report security issues privately to the repo owner before opening a PR.