Hanzo AI 9bacc3b473 ci: add coverage tracking + floor gate + HQC PQClean e2e job ...

Three additions to the crypto CI workflow:

1) Coverage tracking on the CGO build, amd64 only (canonical baseline).
   Excludes the `verkle` package which has pre-existing encoding-type
   test failures unrelated to coverage; everything else contributes.
   Output: coverage.txt + a `go tool cover -func` summary line in the
   CI log. Reports total %.

2) Coverage floor gate: fail CI if total coverage drops below 60%.
   The current baseline (measured locally) is 59.7%; the floor is
   set at 60% as a starting line that ratchets upward over time.
   Any PR that drops below the floor trips `exit 2`. Floor bumps are
   manual (edit this file).

3) HQC PQClean cgo e2e job: build + test crypto/hqc/ with the
   `-tags=hqc_pqclean` tag set. This exercises the real PQClean
   backend (NIST KATs byte-for-byte + roundtrip determinism) on every
   push, not just the stub path.

Plus: `-race -timeout=15m` on the standard test run (was no -race),
and codecov upload (continue-on-error since CODECOV_TOKEN may not be
set in fork PRs).

Verkle test failure ("invalid encoding type, got 2, expected 3" in
TestParseNodeEoA / TestParseNodeSingleSlot) is a pre-existing
structural bug in the encoding-type discriminator. Excluding it from
the coverage measurement is the right move for now; the failure
should be fixed in a separate commit dedicated to verkle.

2026-05-16 16:59:46 -07:00

..

workflows

ci: add coverage tracking + floor gate + HQC PQClean e2e job

2026-05-16 16:59:46 -07:00