ci: add mainline coverage job (aws#4288)

README.md

@@ -111,6 +111,8 @@ In addition to code reviews, s2n-tls is subject to regular static analysis, fuzz
 
 s2n-tls includes positive and negative unit tests and end-to-end test cases.
 
+Unit test coverage can be viewed [here](https://dx1inn44oyl7n.cloudfront.net/main/index.html). Note that this represents unit coverage for a particular build. Since that build won't necessarily support all s2n-tls features, test coverage may be artificially lowered.
+
 ##### Erase on read
 s2n-tls encrypts or erases plaintext data as quickly as possible. For example, decrypted data buffers are erased as they are read by the application.
 

codebuild/spec/buildspec_generalbatch.yml

@@ -335,14 +335,6 @@ batch:
           S2N_NO_PQ: 1
           TESTS: unit
       identifier: s2nUnitClang15
-    - identifier: s2nUnitCoverage
-      buildspec: codebuild/spec/buildspec_unit_coverage.yml
-      env:
-        privileged-mode: true
-        compute-type: BUILD_GENERAL1_LARGE
-        image: 024603541914.dkr.ecr.us-west-2.amazonaws.com/docker:ubuntu22codebuild
-        variables:
-          S2N_LIBCRYPTO: openssl-1.1.1
     - identifier: 32BitBuildAndUnit
       buildspec: codebuild/spec/buildspec_32bit_cross_compile.yml
       env:

codebuild/spec/buildspec_unit_coverage.yml

@@ -14,30 +14,32 @@
 version: 0.2
 
 env:
-  parameter-store:
-    CODECOV_TOKEN : codecov-upload-token
   variables:
     # CODEBUILD_ is a reserved namespace.
     CB_BIN_DIR: "./codebuild/bin"
     CC: "/usr/bin/clang"
     CXX: "/usr/bin/clang++"
 
 phases:
-  pre_build:
-    commands:
-      - |
-        if [ -d "third-party-src" ]; then
-          cd third-party-src;
-          ln -s /usr/local $CODEBUILD_SRC_DIR/third-party-src/test-deps;
-        fi
-      - ln -s /usr/local $CODEBUILD_SRC_DIR/test-deps
   build:
     on-failure: ABORT
     commands:
-      - $CB_BIN_DIR/coverage_build.sh
+    # LLVM complains about corrupt coverage information
+    # for static targets, so compile to a shared lib
+    # instead.
+      - |
+        cmake . -Bbuild \
+          -DCOVERAGE=ON \
+          -DCMAKE_PREFIX_PATH=$LIBCRYPTO_ROOT \
+          -DBUILD_SHARED_LIBS=ON
+      - cmake --build ./build -- -j $(nproc)
   post_build:
     on-failure: ABORT
     commands:
-      - LLVM_PROFILE_FILE="ut_%p.profraw" CTEST_PARALLEL_LEVEL=$(nproc) cmake --build ./build --target test ARGS="--output-on-failure -L unit"
+      - LLVM_PROFILE_FILE="ut_%8m.profraw" CTEST_PARALLEL_LEVEL=$(nproc) cmake --build ./build --target test ARGS="--output-on-failure -L unit"
       - $CB_BIN_DIR/coverage_report.sh
-      - $CB_BIN_DIR/coverage_upload.sh
+artifacts:
+  # upload all files in the coverage_report directory
+  files:
+    - '**/*'
+  base-directory: coverage_report