ci: add lint workflow and unify coverage reporting

.github/workflows/_test.yml

@@ -23,6 +23,11 @@ on:
         required: false
         default: false
         type: boolean
+      with-coverage:
+        description: "Whether to run tests with coverage reporting"
+        required: false
+        default: false
+        type: boolean
 
 defaults:
   run:
@@ -89,8 +94,23 @@ jobs:
             poetry install --with dev
           fi
 
-      - name: Run pre-commit hooks
-        run: poetry run make pre_commit
+      - name: Run pytest with coverage
+        if: inputs.with-coverage
+        run: poetry run pytest --cov=nemoguardrails tests/ --cov-report=xml:coverage.xml -v
 
-      - name: Run pytest
+      - name: Run pytest without coverage
+        if: inputs.with-coverage == false
         run: poetry run pytest -v
+
+      - name: Upload coverage to Codecov
+        if: inputs.with-coverage
+        uses: codecov/codecov-action@v5
+        with:
+          directory: ./coverage/reports/
+          env_vars: PYTHON
+          fail_ci_if_error: true
+          files: ./coverage.xml
+          flags: python
+          name: codecov-umbrella
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true

.github/workflows/lint.yml

@@ -0,0 +1,54 @@
+name: Lint
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - develop
+  workflow_dispatch:
+
+env:
+  POETRY_VERSION: 1.8.2
+  PYTHON_VERSION: "3.11"
+
+jobs:
+  lint:
+    name: Lint Code
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Get full Python version
+        id: full-python-version
+        run: echo "version=$(python -c "import sys; print('-'.join(str(v) for v in sys.version_info))")" >> $GITHUB_OUTPUT
+
+      - name: Bootstrap poetry
+        run: |
+          curl -sSL https://install.python-poetry.org | POETRY_VERSION=${{ env.POETRY_VERSION }} python -
+          echo "$HOME/.local/bin" >> $GITHUB_PATH
+
+      - name: Configure poetry
+        run: poetry config virtualenvs.in-project true
+
+      - name: Set up cache
+        uses: actions/cache@v4
+        id: cache
+        with:
+          path: .venv
+          key: venv-${{ runner.os }}-${{ steps.full-python-version.outputs.version }}-${{ hashFiles('**/poetry.lock') }}
+
+      - name: Ensure cache is healthy
+        if: steps.cache.outputs.cache-hit == 'true'
+        run: timeout 10s poetry run pip --version || rm -rf .venv
+
+      - name: Install dependencies
+        run: poetry install --with dev
+
+      - name: Run pre-commit hooks
+        run: poetry run make pre_commit

.github/workflows/pr-tests-skip.yml

@@ -0,0 +1,14 @@
+name: Skip PR Tests
+
+on:
+  pull_request:
+    paths:
+      - "**/*.md"
+      - ".github/**"
+
+jobs:
+  pr-tests-summary:
+    name: PR Tests Summary
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Tests skipped (no code changes)"

.github/workflows/pr-tests.yml

@@ -2,8 +2,8 @@ name: PR Tests
 
 on:
   pull_request:
-    # we don't ignore markdkowns to run pre-commits
     paths-ignore:
+      - "**/*.md"
       - ".github/**"
 
 jobs:
@@ -15,12 +15,16 @@ jobs:
         include:
           - os: Ubuntu
             image: ubuntu-latest
+          - python-version: "3.11"
+            with-coverage: true
       fail-fast: false
     uses: ./.github/workflows/_test.yml
+    secrets: inherit
     with:
       os: ${{ matrix.os }}
       image: ${{ matrix.image }}
       python-version: ${{ matrix.python-version }}
+      with-coverage: ${{ matrix.with-coverage || false }}
   pr-tests-summary:
     name: PR Tests Summary
     needs: pr-tests-matrix