Coverage: drop docker container, split into two independent builds

[gagelarsen]

Summary

Three layered fixes to stabilize the Coverage workflow. xmscore Coverage CI was failing for two reasons that compounded:

1. Stale xmsconan in the runner image — the conan-gcc13-py3.13 docker image baked xmsconan in, and pip install xmsconan>=X.Y.Z silently no-op'd whenever the image's pinned version already satisfied the floor. So the canary was locked to whatever xmsconan the image happened to carry, not what was on devpi.
2. The combined pybind=True + testing=True + Debug coverage config was structurally fragile — it existed nowhere else in the build matrix, so any change to testing_sources linkage or pybind ABI silently broke Coverage. Most recent symptom: undefined symbol: CxxTest::charToString at pybind dlopen after commit 1d054c2 moved testing_sources out of the main library. Issues xmsconan_coverage passes flat filter to build.py; pybind/testing criteria silently dropped #62, After #61/#62 fixed, testing=True + pybind=True still matches zero configs (mutually exclusive fan-outs) #64, _find_coverage_package picks non-deterministic Python version when python_versions has >1 entry #65, xmsconan_coverage builds without --coverage because XMS_COVERAGE isn't in the conan buildenv #69, xmsconan_coverage reports Python 0% because it looks for cov-py.* at the wrong path #71 all clustered around this same shape.

1. Coverage goes containerless

The Coverage workflow no longer uses any docker container. It runs directly on ubuntu-latest, sets up Python via actions/setup-python@v5, and pip-installs conan / gcovr / xmsconan on every run. ubuntu-latest currently ships gcc 13.3 which matches the conan profile's compiler.version=13. For libraries that set [ci].xvfb = true, the workflow apt-installs xvfb as a job step instead of pulling a custom X11/GDAL container. This removes the hidden coupling between the runner-image refresh cadence and what xmsconan version the canary actually ran.

2. --upgrade added to remaining CI templates

github-ci.yaml.jinja and gitlab-ci.yml.jinja still use docker images for the build/deploy/lint workflows (manylinux compatibility for wheel repair, locked compiler for ABI stability). Those installs gain --upgrade and quoted constraints so they don't silently lock to a baked-in xmsconan when one happens to be in the image.

3. Coverage split into two independent builds

Replace the single combined pybind=True + testing=True + Debug coverage config with two independent builds:

• C++ coverage build: testing=True, pybind=False, Debug — drives CxxTest under --coverage. gcovr reads .gcda from this build folder.
• Python coverage build: pybind=True, testing=False, Debug, pinned to one python_version — drives pytest-cov against the wheel. cov-py.xml/cov-py-summary.json/coverage-html-py are copied out of this build folder.

xmsconan_coverage runs build.py twice (sequentially, one job, shared conan cache), locates each package via _find_coverage_package(kind={"testing"|"pybind"}), runs gcovr against the testing folder, and copies pytest-cov artifacts from the pybind folder. The packager no longer emits a coverage-only carve-out — the matrix is asserted to never produce a pybind=True + testing=True config regardless of XMS_COVERAGE.

Coverage number impact: libraries that previously relied on pybind-driven C++ coverage may see their C++ percentage drop, since only CxxTest-reachable code now contributes to cov-cpp.xml. xmscore is unaffected (cpp_threshold=0); downstream libraries with non-zero cpp_threshold should re-baseline against the testing-only build.

Downstream propagation

xms libraries pick this up by regenerating CI yamls with xmsconan ci once 2.15.2 is on devpi. xmscore in particular needs to regenerate Coverage.yaml so the testing_sources fix from 2.15.1 AND the two-build split reach its CI runner.

What this drops

• The conan-gcc13-py3.13 runner image for Coverage (was the default).
• The conan-gcc13-x11-gdal-py3.13 runner image for ci_xvfb=true Coverage (now apt installs xvfb instead).
• The [ci].docker_image override on the Coverage workflow specifically. It's still honored by build/deploy workflows.
• The XmsConanPackager _coverage carve-out that flipped testing=True on the Debug+pybind variant when XMS_COVERAGE=1.

If any xms library was relying on libraries pre-baked into those images beyond what apt provides on ubuntu-latest, that library will need to add explicit install steps to its workflow (likely via the existing template extension points).

Documentation updates

• docs/USAGE.md §5.7 — [coverage].python_version row rewritten to describe the pybind-build pinning.
• docs/USAGE.md §7.2 — testing option row clarified as mutually exclusive with pybind=True in the standard fan-out.
• docs/USAGE.md §11 — full two-build flow described (testing build → pybind build → gcovr → threshold gate).
• XMS_COVERAGE=1 documented as the Debug+pybind gate-relaxation switch (the testing-only Debug variant is part of the standard fan-out and no longer needs the env var).

Release plan

Land as 2.15.2 — version is dynamic via setuptools-scm; tag 2.15.2 on master after merge.

Test plan

• pytest tests/ -m "not integration" → 536 passed, 1 skipped.
• flake8 clean on touched files.
• test_github_coverage_yaml_generated_when_coverage_true — asserts the generated workflow has NO container: directive, has actions/setup-python, and uses pip install --upgrade "xmsconan>=…".
• test_github_coverage_apt_installs_xvfb_when_requested — inverted from the old "uses the xvfb docker image" assertion; now confirms xvfb is apt-installed instead.
• test_pybind_and_testing_are_never_combined_in_one_config — asserts the packager never emits the combined config, with or without XMS_COVERAGE.
• test_build_py_invoked_twice_with_disjoint_filters — asserts run_coverage runs build.py twice with disjoint testing/pybind filters.
• test_gcovr_runs_against_testing_build_folder_not_pybind — asserts gcovr --root is the testing folder, not the pybind folder.
• CI Linux Coverage run on this branch produces cov-cpp.xml (testing-only) and cov-py.xml (pybind-only) without the CxxTest::charToString regression.
• xmscore regenerates Coverage.yaml after 2.15.2 lands on devpi; xmscore's Coverage workflow re-runs green.

🤖 Generated with Claude Code