feat: add cargo-tarpaulin coverage reporting (#63)

[bashir347]

Adds line coverage measurement and reporting to the project using cargo-tarpaulin.

Changes

• tarpaulin.toml — new config file. Key decisions:

  • lib = true because the crate is cdylib; tarpaulin can't instrument a wasm binary so it
    targets the native test binary instead
  • fail-under = 90 enforces the >90% line coverage acceptance criterion on every CI run
  • out = ["Html", "Xml"] for a browsable report and Cobertura XML for Codecov
  • Excludes src/test.rs, src/security_test.rs, src/prop_test.rs, src/constants.rs — test
    scaffolding and empty files shouldn't skew the metric

• .github/workflows/ci.yml — coverage job updated:

  • Cargo registry cache to avoid reinstalling tarpaulin on every run
  • Idempotent install guard (command -v cargo-tarpaulin)
  • Runs cargo tarpaulin --config tarpaulin.toml (explicit config path)
  • Uploads cobertura.xml to Codecov via codecov/codecov-action@v4; fail_ci_if_error: false so a
    Codecov outage doesn't break CI
  • HTML report uploaded as a 30-day artifact

• README.md — Codecov badge added

• .gitignore — /coverage/ excluded

• Makefile — make coverage target added for local use

Setup required

Add a CODECOV_TOKEN secret in Settings → Secrets → Actions (token from codecov.io
(https://codecov.io) after linking the repo). The badge won't update without it, but CI won't
fail thanks to fail_ci_if_error: false.

Testing

Run locally with:

cargo install cargo-tarpaulin --locked
make coverage

report at coverage/tarpaulin-report.html

closes #63

[drips-wave]

@bashir347 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits