Add code coverage to Toga

[saroad2]

Add coverage tests to Toga core abilities. we are now on 91% coverage!

This PR is missing us to add CODECOV_TOKEN to the repository's secrets.

PR Checklist:

• All new features have been tested
• All new features have been documented
• I have read the CONTRIBUTING.md file
• I will abide by the code of conduct

[freakboy3742]

Looks good to me (and I'm a little shocked that coverage is as high as 91%...)

[samschott]

@saroad2, this may be a stupid question but I thought I would ask here:

I can see that the coverage report is uploaded on every PR, even from non-maintainers. However, github secrets such as secrets.CODECOV_TOKEN should not be available to outside branches. How does this work? I am probably missing something really obvious.

[saroad2]

Let me start with the fact the CodeCov has a major bug with its coverage reports. I'm thinking about removing our integration with them and switch to something else.

As for the secret, it's available for Github Actions, not for the users. that's the reason it can run on every PR. the users themselves don't have access to the secret.

[samschott]

Not sure I understand. Couldn't the PR modify the Github Action itself to upload the secret to some server? From the GitHub docs:

With the exception of GITHUB_TOKEN, secrets are not passed to the runner when a workflow is triggered from a forked repository.

AFAIK, this includes PRs from forked repositories.

It looks like CodeCov might not actually use the secret at all during upload if the PR comes from an external fork: codecov/codecov-action#29.

In any case, it seems to be working, apart from issues with the coverage reports themselves...