ci: gate PRs on 100% patch coverage + 95% project floor

.github/workflows/coverage.yml

@@ -42,6 +42,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           path: provisioner
+          # Full history so diff-cover can resolve origin/<base_ref>.
+          fetch-depth: 0
       - uses: actions/checkout@v4
         with:
           repository: InstaNode-dev/common
@@ -68,3 +70,55 @@ jobs:
           files: provisioner/coverage.out
           flags: provisioner
           fail_ci_if_error: false
+
+      # ------------------------------------------------------------------
+      # Org patch-coverage mandate: every changed line in a PR diff must be
+      # covered by a test (100%), and the project floor stays >=95%.
+      # Tool: diff-cover (https://github.com/Bachmann1234/diff-cover).
+      # ------------------------------------------------------------------
+      - uses: actions/setup-python@v5
+        if: github.event_name == 'pull_request'
+        with:
+          python-version: '3.12'
+      - name: Install diff-cover + cobertura converter
+        if: github.event_name == 'pull_request'
+        run: |
+          pip install diff-cover
+          go install github.com/boumenot/gocover-cobertura@latest
+      - name: Convert coverage to Cobertura
+        if: github.event_name == 'pull_request'
+        working-directory: provisioner
+        run: $(go env GOPATH)/bin/gocover-cobertura < coverage.out > coverage.xml
+      - name: Patch coverage gate (100% of changed lines)
+        if: github.event_name == 'pull_request'
+        working-directory: provisioner
+        run: |
+          git fetch origin "${{ github.base_ref }}" --depth=1 || true
+          diff-cover coverage.xml \
+            --compare-branch="origin/${{ github.base_ref }}" \
+            --fail-under=100
+      - name: Project coverage floor (>=95% production code)
+        if: github.event_name == 'pull_request'
+        working-directory: provisioner
+        # The >=95% floor is measured over PRODUCTION code only. We drop
+        # genuinely-non-shippable packages from the coverage profile before
+        # computing the total — this is correct measurement, NOT a waiver.
+        # No internal/<domain> production package is ever excluded here.
+        #
+        # Excluded (and why):
+        #   cmd/smoke-buildinfo   — diagnostic/smoke binary, not shipped logic.
+        #   cmd/*                 — pure diagnostic/smoke binaries.
+        #   internal/testhelpers  — test-DB/setup harness (none today; future-proof).
+        #   e2e/                  — black-box E2E suite (//go:build e2e; none today).
+        #   proto/gen, *_pb.go    — generated protobuf code.
+        # Build-tag-gated files (//go:build e2e|integration|chaos|loadtest)
+        # are not compiled into the `-short` run, so they never appear in
+        # coverage.out — the path filter below is belt-and-suspenders.
+        run: |
+          # Keep the `mode:` header line; drop excluded package paths.
+          grep -vE '(/internal/testhelpers/|/cmd/|/e2e/|/proto/gen/|_pb\.go:)' \
+            coverage.out > coverage.prod.out
+          total=$(go tool cover -func=coverage.prod.out | tail -1 | awk '{print $3}' | tr -d '%')
+          echo "Total project coverage: ${total}%"
+          awk -v t="$total" 'BEGIN { exit (t+0 >= 95) ? 0 : 1 }' \
+            || { echo "::error::Production coverage ${total}% is below the 95% floor"; exit 1; }