CI Coverage Workflow Has Two Blind Spots — Excludes Root Modules and Uses Outdated Codecov Action

[kunal-10-cloud]

Description

The coverage.yml workflow (line 24) only measures coverage for the anoph/ subpackage:

run: poetry run pytest -v tests --ignore tests/integration --cov malariagen_data/anoph --cov-report=xml

This completely excludes coverage measurement for:

• malariagen_data/ag3.py, af1.py, adir1.py, amin1.py, adar1.py (all species-specific entry points)
• malariagen_data/pf7.py, pf8.py, pf9.py, pv4.py (all Plasmodium modules)
• malariagen_data/plasmodium.py (core Plasmodium data resource)
• malariagen_data/veff.py (variant effect annotation)
• malariagen_data/util.py (shared utilities)
• malariagen_data/plotly_dendrogram.py

Additionally, the workflow uses codecov/codecov-action@v3 (line 27) while v4 has been available since early 2024 with security fixes.

How to Reproduce

# Check the coverage report after a CI run on master:
# 1. Go to Codecov dashboard for malariagen/malariagen-data-python
# 2. Note that ag3.py, plasmodium.py, veff.py, util.py show 0% coverage
# 3. Note that PRs never trigger coverage checks at all

Why It Is Important

• plasmodium.py is the entire Plasmodium data access layer (Pf7, Pf8, Pf9, Pv4) — it has zero coverage tracking despite being actively developed (Pf9 was just added in PR Adding Pf9 functionality #1236).
• veff.py has had multiple recent bugs (Bug: TODO Strings Returned as Real Variant Effect Values in veff.py #916, veff.py: SYNONYMOUS_STOP and SYNONYMOUS_START effects not correctly classified #953, veff.py: in-frame complex variants return literal "TODO" string as effect label #1132, Enhance variant effect annotation: classify in-frame complex variants properly in veff.py #1180) — coverage tracking would have caught regressions.
• util.py contains shared utilities used by every module; regressions there cascade everywhere.
• The ag3.py/af1.py entry points contain species-specific configurations (palettes, URLs, config paths) that are never coverage-verified.

Expected Impact After Resolution

Coverage tracking covers the full malariagen_data/ package. Regressions in Plasmodium, veff, and utility code are caught before merge. Codecov action is updated to v4 for security.

[kunal-10-cloud]

Hi @jonbrenas, i have raised a PR(#1302 ) against this issue, please look at it once whenever you are available
Please let me know if any changes are required