coverage.yml is the most logic-dense workflow here and the only one with no test

Priority: medium-high. It is the workflow most likely to break silently, and the one nothing checks.

What

self-check.yml runs exactly two legs — actionlint and codeql. Neither executes a workflow; they lint YAML and analyse it statically.

That is fine for most of this repository, where a stub is a thin uses: plus inputs. It is not fine for coverage.yml, which carries by far the most logic of anything here:

• a read -ra split of the exclude input into --exclude flags, with a comment explaining why an unquoted expansion breaks
• five --exclude-lines-by-pattern / --exclude-branches-by-pattern regexes
• --merge-lines, --fail-under-line, --fail-under-branch
• three consumers of the report files: the step summary, the Codecov upload, the artifact upload

Every one of those can break in a way actionlint and CodeQL cannot see. A wrong exclude pattern silently changes what 100% means — it does not fail, it just measures something else.

This is not hypothetical: #37 changes where gcovr writes its reports and touches all three consumers, and merges on green CI that never once ran the workflow.

Shape of a fix

A minimal C++ fixture in this repository — one header, one Boost.Test file that covers it fully — and a self-check leg calling coverage.yml against it. Then the assertions worth having:

• it reaches 100% on the fixture and the job is green
• deleting the test, or adding an uncovered branch, makes it fail — the gate is the point, and a threshold that never fires is the bug we would be trying to catch
• the exclude input actually excludes: a deliberately uncovered file under an excluded path keeps the run green
• the report files land where the downstream steps look for them

Item 2 matters most. Everything else here can be wrong in a way that still shows green.

Cost

A fixture plus one Ubuntu leg, at the cadence self-check already runs (push, PR, weekly cron). It also gives the other ladder workflows somewhere to point when they want the same treatment.

Related

• #26 item 5 proposes self-check.yml querying the packagers for ladder freshness. Same instinct — cpp-ci owning the checking of its own claims — applied to the table rather than the workflows.

Read coverage.yml and self-check.yml first, then trace the three report consumers and the existing self-check cadence. Add the minimal C++ fixture and an Ubuntu self-check leg; done means the fixture reaches 100%, uncovered code fails the gate, excluded files stay excluded, and reports land where downstream steps expect them.