Skip to content
Latchkey

Coverage workflow (knex/knex)

The Coverage workflow from knex/knex, explained and optimized by Latchkey.

F

CI health: F - at risk

Point runs-on at Latchkey and get caching, run de-duplication, job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →
Source: knex/knex.github/workflows/coverage.ymlLicense MITView source

What it does

This is the Coverage workflow from the knex/knex repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)
---
name: Coverage

on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master

permissions:
  contents: read

jobs:
  build:
    # skip on:
    #   - PRs labeled `skip-tests` (changes that can't affect runtime
    #     behaviour: docs, CI scripts, release tooling)
    #   - the auto-generated "release X.Y.Z" commit pushed by the
    #     release workflow (only changes lib/**, package.json, and
    #     changelogs; same source already tested on the parent commit)
    if: >-
      ${{
        !contains(github.event.pull_request.labels.*.name, 'skip-tests') &&
        !(github.actor == 'github-actions[bot]' && startsWith(github.event.head_commit.message, 'release '))
      }}
    env:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
    permissions:
      checks: write # for coverallsapp/github-action to create new checks
      contents: read # for actions/checkout to fetch code
    runs-on: ubuntu-latest

    name: Coverage

    strategy:
      fail-fast: false
      matrix:
        node-version: [22.x]

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Setup Node ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          always-auth: false
          package-manager-cache: false
          node-version: ${{ matrix.node-version }}

      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
        if: env.DOCKERHUB_USERNAME != ''

      - name: Start Databases
        run: npm run db:start:no-oracle

      - name: Run npm install
        run: |
          n=0
          until npm install; do
            n=$((n + 1))
            if [ "$n" -ge 3 ]; then
              echo "npm install failed after $n attempts"
              exit 1
            fi
            echo "npm install failed, retrying in 15s... (attempt $n)"
            sleep 15
          done

      - name: Install pg-native
        run: npm i pg-native

      - run: npm run build

      - name: Run Tests
        run: npm run test:coverage  || true
        env:
          CI: true
          DB: 'postgres pgnative mysql mysql2 mariadb mssql sqlite3 cockroachdb'
          KNEX_TEST_TIMEOUT: 60000

      - name: Stop Databases
        run: npm run db:stop

      - name: Generate LCOV
        run: npx nyc report --reporter=lcov

      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: knex/knex

The same workflow, on Latchkey

Estimated ~20% faster on cache hits, plus fewer wasted runs and a safer supply chain. Added and changed lines are highlighted.

---
name: Coverage
 
on:
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
 
permissions:
  contents: read
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  build:
    timeout-minutes: 30
    # skip on:
    #   - PRs labeled `skip-tests` (changes that can't affect runtime
    #     behaviour: docs, CI scripts, release tooling)
    #   - the auto-generated "release X.Y.Z" commit pushed by the
    #     release workflow (only changes lib/**, package.json, and
    #     changelogs; same source already tested on the parent commit)
    if: >-
      ${{
        !contains(github.event.pull_request.labels.*.name, 'skip-tests') &&
        !(github.actor == 'github-actions[bot]' && startsWith(github.event.head_commit.message, 'release '))
      }}
    env:
      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
    permissions:
      checks: write # for coverallsapp/github-action to create new checks
      contents: read # for actions/checkout to fetch code
    runs-on: latchkey-small
 
    name: Coverage
 
    strategy:
      fail-fast: false
      matrix:
        node-version: [22.x]
 
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1
 
      - name: Setup Node ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          cache: 'npm'
          always-auth: false
          package-manager-cache: false
          node-version: ${{ matrix.node-version }}
 
      - name: Login to Docker Hub
        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
        if: env.DOCKERHUB_USERNAME != ''
 
      - name: Start Databases
        run: npm run db:start:no-oracle
 
      - name: Run npm install
        run: |
          n=0
          until npm install; do
            n=$((n + 1))
            if [ "$n" -ge 3 ]; then
              echo "npm install failed after $n attempts"
              exit 1
            fi
            echo "npm install failed, retrying in 15s... (attempt $n)"
            sleep 15
          done
 
      - name: Install pg-native
        run: npm i pg-native
 
      - run: npm run build
 
      - name: Run Tests
        run: npm run test:coverage  || true
        env:
          CI: true
          DB: 'postgres pgnative mysql mysql2 mariadb mssql sqlite3 cockroachdb'
          KNEX_TEST_TIMEOUT: 60000
 
      - name: Stop Databases
        run: npm run db:stop
 
      - name: Generate LCOV
        run: npx nyc report --reporter=lcov
 
      - name: Upload coverage reports to Codecov
        uses: codecov/codecov-action@v5
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          slug: knex/knex
 

What changed

2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow