Enforce minimum code coverage threshold in CI pipeline (Azure#7188)

* Enforce minimum code coverage threshold in CI pipeline

Add a coverage gate to the CodeCoverage_Upload stage that fails the build
when total statement coverage drops below a configured minimum.

- New Test-CodeCoverageThreshold.ps1 script parses 'go tool cover -func'
  output and fails if coverage is below the threshold
- New MinimumCoveragePercent parameter on code-coverage-upload.yml
  (default 0 = disabled)
- Set threshold to 80% in release-cli.yml to validate the mechanism
  (will be adjusted to the actual floor after verification)

Fixes Azure#7187

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix coverage threshold step to use PowerShell task directly

The previous approach nested 'pwsh -File' inside a pwsh inline step,
which caused $CoverageFile to be treated as a literal string instead
of the script parameter. Switch to PowerShell@2 task with targetType:
filePath so arguments are passed correctly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Fix PowerShell variable interpolation in go tool cover argument

Double-quote the '-func=$CoverageFile' argument so PowerShell expands
the variable. Without quotes, PowerShell passes the literal string
'$CoverageFile' to the go command.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Set workingDirectory to cli/azd for go tool cover module resolution

go tool cover -func needs to resolve Go module paths from the coverage
file. Run the threshold check from cli/azd/ where go.mod lives, and
pass the absolute path to cover.out.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR review feedback

- Set threshold to 48% to match current baseline
- Add ValidateRange(0,100) on MinimumCoveragePercent parameter
- Find total line by 'total:' prefix instead of assuming last line
- Match both integer and decimal percentages with invariant culture parsing
- Add condition: succeededOrFailed() to PublishCodeCoverageResults so
  coverage reports are still uploaded when the threshold check fails

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 2 people

eng/pipelines/release-cli.yml

@@ -125,6 +125,7 @@ extends:
 
     - template: /eng/pipelines/templates/stages/code-coverage-upload.yml
       parameters:
+        MinimumCoveragePercent: 48
         DownloadArtifacts:
           - cover-win
           - cover-lin

eng/pipelines/templates/stages/code-coverage-upload.yml

@@ -5,6 +5,9 @@ parameters:
       - cover-win
       - cover-lin
       - cover-mac
+  - name: MinimumCoveragePercent
+    type: number
+    default: 0
 stages: 
 - stage: CodeCoverage_Upload
   condition: and(succeeded(), ne(variables['Skip.LiveTest'], 'true'))
@@ -59,7 +62,18 @@ stages:
           }
         displayName: Merge code coverage files
 
+      - ${{ if gt(parameters.MinimumCoveragePercent, 0) }}:
+        - task: PowerShell@2
+          inputs:
+            pwsh: true
+            targetType: filePath
+            filePath: $(Build.SourcesDirectory)/eng/scripts/Test-CodeCoverageThreshold.ps1
+            arguments: -CoverageFile $(Build.SourcesDirectory)/cover.out -MinimumCoveragePercent ${{ parameters.MinimumCoveragePercent }}
+            workingDirectory: $(Build.SourcesDirectory)/cli/azd
+          displayName: Check code coverage threshold
+
       - task: PublishCodeCoverageResults@1
+        condition: succeededOrFailed()
         inputs:
           codeCoverageTool: Cobertura
           summaryFileLocation: '$(Build.SourcesDirectory)/**/coverage.xml'

eng/scripts/Test-CodeCoverageThreshold.ps1

@@ -0,0 +1,67 @@
+#!/usr/bin/env pwsh
+
+<#
+.SYNOPSIS
+    Checks that code coverage meets a minimum threshold.
+
+.DESCRIPTION
+    Parses a Go coverage profile using 'go tool cover -func' to extract the
+    total statement coverage percentage, then fails if it is below the
+    specified minimum.
+
+.PARAMETER CoverageFile
+    Path to the Go coverage profile (typically cover.out).
+
+.PARAMETER MinimumCoveragePercent
+    The minimum acceptable coverage percentage (0-100). The script exits
+    with a non-zero code when coverage is below this value.
+
+.EXAMPLE
+    ./Test-CodeCoverageThreshold.ps1 -CoverageFile cover.out -MinimumCoveragePercent 48
+#>
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$CoverageFile,
+
+    [Parameter(Mandatory = $true)]
+    [ValidateRange(0, 100)]
+    [double]$MinimumCoveragePercent
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not (Test-Path $CoverageFile)) {
+    throw "Coverage file '$CoverageFile' not found"
+}
+
+Write-Host "Checking code coverage threshold (minimum: $MinimumCoveragePercent%)..."
+
+# Use 'go tool cover -func' to get per-function coverage and the total line.
+$output = & go tool cover "-func=$CoverageFile"
+if ($LASTEXITCODE) {
+    throw "go tool cover -func failed: $output"
+}
+
+# Find the "total:" summary line, which looks like: "total:  (statements)  48.3%"
+$totalLine = $output | Where-Object { $_ -match '^\s*total:' } | Select-Object -Last 1
+
+if (-not $totalLine) {
+    throw "Could not find 'total:' line in 'go tool cover -func' output"
+}
+
+# Match both integer (100%) and decimal (48.3%) percentages using invariant culture
+if ($totalLine -match '(\d+(?:\.\d+)?)%') {
+    $coveragePercent = [double]::Parse($matches[1], [System.Globalization.CultureInfo]::InvariantCulture)
+} else {
+    throw "Could not parse coverage percentage from: $totalLine"
+}
+
+Write-Host "Total statement coverage: $coveragePercent%"
+
+if ($coveragePercent -lt $MinimumCoveragePercent) {
+    Write-Host "##vso[task.logissue type=error]Code coverage $coveragePercent% is below the minimum threshold of $MinimumCoveragePercent%."
+    exit 1
+}
+
+Write-Host "Coverage $coveragePercent% meets the minimum threshold of $MinimumCoveragePercent%. ✓"