perf(ci): balance runner cost and latency

.github/workflows/ci.yml

@@ -71,9 +71,19 @@ jobs:
       - run: pnpm openapi:client:check
 
   tests-node:
-    name: Tests / Node
+    name: Tests / ${{ matrix.label }}
     runs-on: ubuntu-latest
     if: github.repository == 'saltbo/zpan'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: Unit
+            project: unit
+            report: unit
+          - label: Integration
+            project: integration
+            report: integration
     steps:
       - uses: actions/checkout@v6
       - uses: pnpm/action-setup@v4
@@ -82,18 +92,16 @@ jobs:
           node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - name: Run Unit and Integration tests with coverage
-        env:
-          COVERAGE_ENFORCE: '1'
-        run: pnpm exec vitest run --project unit --project integration --coverage --coverage.reportsDirectory=coverage/node
-      - uses: codecov/codecov-action@v5
+      - name: Run tests with coverage
+        run: pnpm exec vitest run --project ${{ matrix.project }} --coverage --coverage.reportsDirectory=coverage/${{ matrix.report }} --reporter=default --reporter=blob --outputFile.blob=.vitest-reports/${{ matrix.report }}.blob
+      - uses: actions/upload-artifact@v4
         if: always()
         with:
-          files: coverage/node/coverage-final.json
-          flags: unit,integration
-          disable_search: true
-          fail_ci_if_error: false
-          handle_no_reports_found: true
+          name: vitest-coverage-${{ matrix.report }}
+          path: .vitest-reports/${{ matrix.report }}.blob
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 1
 
   tests-cf:
     name: Tests / Cloudflare
@@ -110,44 +118,87 @@ jobs:
       - run: mkdir -p dist
       - run: pnpm test:cf
 
-  package-smoke:
-    name: Package smoke / Docker images
+  coverage:
+    name: Tests / Coverage
     runs-on: ubuntu-latest
     if: github.repository == 'saltbo/zpan'
+    needs: [tests-node]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@v5
+        with:
+          pattern: vitest-coverage-*
+          path: .vitest-reports
+          merge-multiple: true
+      - name: Verify both coverage reports are present
+        run: |
+          test -f .vitest-reports/unit.blob
+          test -f .vitest-reports/integration.blob
+          test "$(find .vitest-reports -type f -name '*.blob' | wc -l)" -eq 2
+      - name: Merge coverage and enforce thresholds
+        env:
+          COVERAGE_ENFORCE: '1'
+        run: pnpm exec vitest --merge-reports=.vitest-reports --coverage --reporter=agent --coverage.reportsDirectory=coverage/merged
+      - uses: codecov/codecov-action@v5
+        if: always()
+        with:
+          files: coverage/merged/coverage-final.json
+          flags: unit,integration
+          disable_search: true
+          fail_ci_if_error: false
+          handle_no_reports_found: true
+
+  package-smoke:
+    name: Package smoke / ${{ matrix.label }}
+    runs-on: ubuntu-latest
+    if: github.repository == 'saltbo/zpan'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: Server image
+            target: ''
+            tag: zpan-zpan:latest
+            cache: docker-server
+          - label: CLI image
+            target: cli
+            tag: zpan-cli-smoke:latest
+            cache: docker-cli
     steps:
       - uses: actions/checkout@v6
       - uses: docker/setup-buildx-action@v4
-      - name: Build server image
+      - name: Build image
         uses: docker/build-push-action@v7
         with:
           context: .
+          target: ${{ matrix.target }}
           load: true
-          tags: zpan-zpan:latest
-          cache-from: type=gha,scope=docker-server
-          cache-to: type=gha,mode=max,scope=docker-server
+          tags: ${{ matrix.tag }}
+          cache-from: type=gha,scope=${{ matrix.cache }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.cache }}
       # Downloader engines and protocol behavior have their own live local job.
       # This smoke gate only needs to prove the current production server image boots.
       - name: Start server image
+        if: matrix.target == ''
         run: docker compose -f docker-compose.yml up -d --no-build --wait --wait-timeout 60 zpan
       - name: Assert server health from host
+        if: matrix.target == ''
         run: curl --fail --retry 5 --retry-delay 3 --retry-connrefused http://localhost:8222/api/health
+      - name: Verify CLI entrypoint
+        if: matrix.target == 'cli'
+        run: docker run --rm zpan-cli-smoke:latest --help
       - name: Dump logs on failure
-        if: failure()
+        if: ${{ failure() && matrix.target == '' }}
         run: docker compose -f docker-compose.yml logs --no-color
       - name: Tear down
-        if: always()
+        if: ${{ always() && matrix.target == '' }}
         run: docker compose -f docker-compose.yml down -v
-      - name: Build CLI image
-        uses: docker/build-push-action@v7
-        with:
-          context: .
-          target: cli
-          load: true
-          tags: zpan-cli-smoke:latest
-          cache-from: type=gha,scope=docker-cli
-          cache-to: type=gha,mode=max,scope=docker-cli
-      - name: Verify CLI entrypoint
-        run: docker run --rm zpan-cli-smoke:latest --help
 
   deployment:
     name: Deployment / Cloudflare contract
@@ -229,6 +280,7 @@ jobs:
       - quality
       - tests-node
       - tests-cf
+      - coverage
       - package-smoke
       - deployment
       - e2e

vitest.config.ts

@@ -39,13 +39,13 @@ const coverageConfig = {
 const coverageGate =
   process.env.COVERAGE_ENFORCE === '1'
     ? {
-        // Lock the combined CI baseline by maximum uncovered items. Unlike rounded
+        // Lock the merged CI baseline by maximum uncovered items. Unlike rounded
         // percentages, negative thresholds cannot hide a small coverage regression.
         thresholds: {
-          statements: -1391,
-          branches: -2202,
-          functions: -1007,
-          lines: -698,
+          statements: -2099,
+          branches: -2869,
+          functions: -1924,
+          lines: -717,
         },
       }
     : {}