[codex] ci: run coverage under Intel SDE

[Fieldnote-Echo]

Summary

• reuse the Intel SDE version, checksum, install, and AVX-512 CPUID probe from ci.yml
• run cargo llvm-cov with the x86_64 target runner set to sde64 -spr --, so instrumented test binaries execute the AVX-512 dispatch paths
• restore the coverage floor from 78% to 85%

Closes #68 once the GitHub Actions coverage job proves the SDE-backed number is stable.

Validation

• pinned actionlint v1.7.12
• pinned zizmor --offline --persona=regular .github/workflows/
• git diff --check

Local validation is static only; the coverage percentage and AVX-512 line execution need the GitHub Actions SDE run.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[qodo-code-review]

Review Summary by Qodo

Run coverage under Intel SDE for AVX-512 code path instrumentation

✨ Enhancement 🧪 Tests

Walkthroughs

Description

• Run coverage instrumentation under Intel SDE to exercise AVX-512 code paths
• Increase coverage floor from 78% to 85% with SDE-backed measurements
• Add AVX-512 CPUID detection sanity check before coverage run
• Reuse Intel SDE version and checksum from existing ci.yml workflow

Diagram

flowchart LR
  A["Coverage Job"] -->|Install Intel SDE| B["SDE 10.7.0"]
  B -->|Sanity Check| C["Verify AVX-512 Detection"]
  C -->|Run Tests| D["cargo llvm-cov with SDE"]
  D -->|Enforce Floor| E["85% Coverage Threshold"]
  E -->|Upload| F["Codecov"]

Loading

File Changes

1. .github/workflows/coverage.yml ✨ Enhancement +48/-8

Integrate Intel SDE into coverage workflow

• Add Intel SDE environment variables (SDE_VERSION, SDE_URL_BASE) to coverage job
• Install Intel SDE with SHA256 verification before running coverage
• Add sanity check step to verify AVX-512 feature detection under SDE
• Configure CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER to execute tests through SDE
• Increase coverage floor from 78% to 85% to reflect full AVX-512 code path coverage
• Update job name to indicate SDE usage

.github/workflows/coverage.yml

---

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. SDE arch not guarded ✓ Resolved 🐞 Bug ☼ Reliability

Description

The coverage job downloads and executes the x86_64 Intel SDE binary (sde64) on ubuntu-latest
without an architecture guard, so the job will fail if the runner architecture is not x86_64.
This breaks coverage generation before cargo llvm-cov runs.

Code

.github/workflows/coverage.yml[R44-56]

Evidence

coverage.yml runs on ubuntu-latest and later executes ${GITHUB_WORKSPACE}/intel-sde/sde64, but
contains no runner-architecture check. The repo’s CI already uses an explicit uname -m dispatch
for other downloaded binaries, demonstrating that missing architecture checks are a known
reliability concern.

.github/workflows/coverage.yml[23-56]
.github/workflows/ci.yml[333-338]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow unconditionally downloads and runs Intel SDE (`sde64`). That binary is x86_64-only, so if the GitHub runner is not x86_64 the coverage job will fail early.

## Issue Context
Other parts of the repo already include architecture-conditional install logic (e.g., wasmtime install branches on `uname -m`), suggesting architecture variability is a considered scenario.

## Fix
Add an explicit x86_64 constraint/guard, e.g.:
- Pin to a known x64 runner label (e.g., `runs-on: ubuntu-24.04`), and/or
- Add a step at the top that checks `uname -m` / `${{ runner.arch }}` and fails with a clear error (or skips) when not `x86_64`/`X64`.

## Fix Focus Areas
- .github/workflows/coverage.yml[23-56]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. SDE pin duplicated ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The SDE version/URL/checksum are now duplicated across ci.yml and coverage.yml, which can drift
and cause one workflow to fail or to test/measure different emulated feature sets than the other.
This increases ongoing maintenance risk for future SDE upgrades.

Code

.github/workflows/coverage.yml[R27-29]

Evidence

coverage.yml defines SDE_VERSION/SDE_URL_BASE and installs SDE using a hardcoded SHA256, and
the same values and install logic already exist in ci.yml’s avx512 job. This creates two
independent places that must be updated in lockstep.

.github/workflows/coverage.yml[27-56]
.github/workflows/ci.yml[236-263]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Intel SDE configuration (version, URL base, SHA256, install script) is duplicated in multiple workflows. This is easy to desynchronize when bumping SDE.

## Issue Context
The new `coverage.yml` job-level `SDE_VERSION`/`SDE_URL_BASE` and the install-step `SDE_SHA256` match the existing `ci.yml` `avx512` job.

## Fix
Factor SDE setup into a shared unit:
- Create a composite action (recommended) like `.github/actions/setup-intel-sde/action.yml` that:
 - accepts `version`, `url_base`, `sha256` as inputs,
 - downloads + verifies + extracts SDE,
 - outputs the installed `sde64` path.
- Use that action from both workflows and store the pin in exactly one place (either action defaults or workflow-level inputs).

## Fix Focus Areas
- .github/workflows/coverage.yml[27-56]
- .github/workflows/ci.yml[236-262]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[Copilot]

Pull request overview

This PR updates the Rust coverage workflow to execute instrumented tests under Intel SDE, allowing AVX-512 runtime dispatch paths to contribute to coverage and restoring the stricter coverage floor.

Changes:

• Installs and verifies Intel SDE in the coverage job.
• Adds an AVX-512 CPUID sanity check under SDE.
• Runs cargo llvm-cov with the SDE target runner and raises the line floor to 85%.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Fieldnote-Echo]

Bot review disposition after follow-up fix:

• Qodo SDE arch not guarded: fixed in f3b6f5b; both SDE jobs now run on ubuntu-24.04, and the shared setup action fails loudly unless uname -m is x86_64 before downloading/running sde64.
• Qodo SDE pin duplicated: fixed in f3b6f5b; .github/actions/setup-intel-sde/action.yml owns the SDE version, URL, checksum, extraction, version check, and sde64 path output for both workflows.
• Copilot codecov.yml drift: fixed in f3b6f5b; Codecov project target/comments now match the 85% SDE-backed coverage workflow.
• Gemini unsupported-file note and Codecov green report required no code change beyond the above workflow/doc alignment.

Validation run locally:

• /tmp/codex-bin/actionlint -color
• git diff --check