Why this matters
Automated gates prevent coverage regressions and make quality visible.
CI must fail the build when line coverage drops below the project threshold (e.g., 80%); publish coverage reports as artifacts.
Automated gates prevent coverage regressions and make quality visible.
Side-by-side examples engineers can pattern-match during review.
steps:
- name: Run tests
run: teststeps:
- name: Run tests with coverage
run: coverage run -m test
- name: Enforce coverage threshold
run: coverage report --fail-under=80
- name: Upload coverage
uses: actions/upload-artifact@v4
with: { name: coverage, path: coverage/ }coverage report --fail-under=80run: test # no coverage gateFrom the same buckets as this rule.
Reject PRs adding real PAN/CVV in fixtures, seeds, or mocks. Only use Luhn-valid test PANs from the gateway or opaque tokens (e.g., tok_) and never include CVV. Add a check to fail if a PAN regex is matched. (PCI DSS data minimization)