fix kj-test & wd-test test coverage reporting

.bazelrc

@@ -68,9 +68,15 @@ build:v8-codegen-opt --per_file_copt=external/abseil-cpp@-O2
 # zlib and tcmalloc (for Linux) are also CPU-intensive, optimize them too.
 build:v8-codegen-opt --per_file_copt=external/tcmalloc@-O2
 build:v8-codegen-opt --per_file_copt=external/zlib@-O2
+# BoringSSL is CPU-intensive for crypto tests, optimize it too.
+build:v8-codegen-opt --per_file_copt=external/boringssl@-O2
+# simdutf is used for fast string encoding/decoding
+build:v8-codegen-opt --per_file_copt=external/+http+simdutf@-O2
 build:v8-codegen-opt-windows --per_file_copt=v8/src@/O2
 build:v8-codegen-opt-windows --per_file_copt=external/abseil-cpp@/O2
 build:v8-codegen-opt-windows --per_file_copt=external/zlib@/O2
+build:v8-codegen-opt-windows --per_file_copt=external/boringssl@/O2
+build:v8-codegen-opt-windows --per_file_copt=external/+http+simdutf@/O2
 
 # In Google projects, exceptions are not used as a rule. Disabling them is more consistent with the
 # canonical V8 build and improves code size. Paths are adjusted for bzlmod mangling – V8 and ICU use
@@ -415,29 +421,59 @@ build:coverage --test_env=BAZEL_USE_LLVM_NATIVE_COVERAGE=1
 # GCOV is used by rules_cc to merge raw profile data (.profraw) into indexed profile data (.profdata)
 build:coverage --action_env=GCOV=llvm-profdata
 build:coverage --test_env=GCOV=llvm-profdata
+# COVERAGE_GCOV_PATH is used by collect_cc_coverage.sh for merging .profraw files.
+build:coverage --action_env=COVERAGE_GCOV_PATH=/usr/bin/llvm-profdata
+build:coverage --test_env=COVERAGE_GCOV_PATH=/usr/bin/llvm-profdata
 # BAZEL_LLVM_COV is used by rules_cc to generate coverage reports from profile data
 build:coverage --action_env=BAZEL_LLVM_COV=llvm-cov
 build:coverage --test_env=BAZEL_LLVM_COV=llvm-cov
-# Enable optimizations to reduce coverage overhead while maintaining good coverage quality
-build:coverage --copt=-O2
-build:coverage --copt=-DNDEBUG
-build:coverage --combined_report=lcov
+# LLVM_COV is used by collect_cc_coverage.sh for generating LCOV output
+build:coverage --test_env=LLVM_COV=llvm-cov
+# GENERATE_LLVM_LCOV=1 tells collect_cc_coverage.sh to use llvm-cov export to generate LCOV format
+# instead of just outputting raw profdata. LLVM_COV specifies the llvm-cov binary to use.
+build:coverage --test_env=GENERATE_LLVM_LCOV=1
 build:coverage --experimental_use_llvm_covmap
 build:coverage --experimental_generate_llvm_lcov
+# Ensure that we fetch coverage data from remote cache
 build:coverage --experimental_fetch_all_coverage_outputs
+build:coverage --experimental_split_coverage_postprocessing
+# Allow coverage outputs to be writable for post-processing
+build:coverage --experimental_writable_outputs
 build:coverage --collect_code_coverage
-build:coverage --instrumentation_filter="^//,-//external"
+# Only instrument source code, not tests or tools - significantly speeds up coverage builds
+build:coverage --instrumentation_filter="^//src/workerd[/:],^//src/rust[/:]"
 build:coverage --instrument_test_targets
+# Disable coverage instrumentation for external dependencies to speed up compilation.
+# Coverage for V8/external code is not useful for our purposes.
+# These flags negate -fprofile-instr-generate and -fcoverage-mapping set by rules_cc.
+build:coverage --per_file_copt=external/.*@-fno-profile-instr-generate,-fno-coverage-mapping
 # KJ uses _exit() by default which bypasses atexit handlers and prevents LLVM profile runtime
 # from writing coverage data. KJ_CLEAN_SHUTDOWN forces use of normal exit() instead.
 build:coverage --test_env=KJ_CLEAN_SHUTDOWN=1
+# Use -O1 for faster compilation - coverage builds don't need heavy optimization
+build:coverage --copt=-O1
+# External dependencies can use -O2 since they're not instrumented anyway
+build:coverage --config=v8-codegen-opt
+# Run coverage-related actions locally with sandboxing - remote execution doesn't support LLVM coverage well
+build:coverage --strategy=TestRunner=worker,sandboxed,local
+build:coverage --strategy=CoverageReport=worker,sandboxed,local
+build:coverage --strategy=CoveragePostprocessing=worker,sandboxed,local
+# Reduce debug info for faster compilation and smaller binaries
+build:coverage --copt=-g1
+# Use limited coverage mode for smaller binaries and faster execution (used by Chromium)
+build:coverage --copt=-mllvm
+build:coverage --copt=-limited-coverage-experimental=true
 coverage --test_tag_filters=-off-by-default,-requires-fuzzilli,-requires-container-engine,-lint,-benchmark,-workerd-benchmark,-no-coverage
+# Let tests know they're running in CI (normally set by ci-test but we can't use that config
+# due to --remote_download_minimal which prevents coverage data from being fetched)
+coverage --test_env=CI=true
+coverage --config=wpt-test
 # Coverage instrumentation slows down test execution, so extend timeouts
 # We disable enormous tests due to the slowdown (CI jobs have a 6h max duration)
 coverage --test_size_filters=-enormous
-coverage --test_timeout=60,240,240,240
+coverage --test_timeout=240,240,240,240
 coverage --build_tests_only
-coverage --config=coverage
+coverage --combined_report=lcov
 
 # This config is defined internally and enabled on many machines.
 # Defining it as empty just so these machines can run build commands from the workerd repo

.github/actions/setup-runner/action.yml

@@ -23,6 +23,8 @@ runs:
           libclang-rt-19-dev \
           llvm-19
         sudo ln -s /usr/bin/llvm-symbolizer-19 /usr/bin/llvm-symbolizer
+        sudo ln -s /usr/bin/llvm-profdata-19 /usr/bin/llvm-profdata
+        sudo ln -s /usr/bin/llvm-cov-19 /usr/bin/llvm-cov
         echo "build:linux --action_env=CC=/usr/lib/llvm-19/bin/clang" >> .bazelrc
         echo "build:linux --host_action_env=CC=/usr/lib/llvm-19/bin/clang" >> .bazelrc
         echo "build:linux --linkopt=--ld-path=/usr/lib/llvm-19/bin/ld.lld" >> .bazelrc

.github/workflows/_bazel.yml

@@ -125,8 +125,6 @@ jobs:
         run: |
           bazel --nowindows_enable_symlinks build ${{ inputs.extra_bazel_args }} --config=ci --profile build-win-workaround.bazel-profile.gz --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev //src/wpt:wpt-all@tsproject //src/node:node@tsproject //src/pyodide:pyodide_static@tsproject
       - name: Bazel build
-        # timestamps are no longer being added here, the GitHub logs include timestamps (Use
-        # 'Show timestamps' on the web interface)
         run: |
           bazel build --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev  --config=ci ${{ inputs.extra_bazel_args }} //...
       - name: Build and load container images
@@ -142,23 +140,20 @@ jobs:
         if: inputs.run_tests
         run: |
           bazel test --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev --config=ci ${{ inputs.extra_bazel_args }} ${{ inputs.test_target }}
-      - name: Setup LLVM tools for coverage
-        if: inputs.run_coverage
-        run: |
-          sudo apt-get update && sudo apt-get install -y llvm
-          sudo ln -sf /usr/bin/llvm-profdata /usr/local/bin/llvm-profdata
-          sudo ln -sf /usr/bin/llvm-cov /usr/local/bin/llvm-cov
       - name: Bazel coverage
         if: inputs.run_coverage
         run: |
-          bazel coverage --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev --config=ci --config=coverage ${{ inputs.extra_bazel_args }} ${{ inputs.test_target }}
+          bazel coverage --remote_cache=https://bazel:${{ secrets.BAZEL_CACHE_KEY }}@bazel-remote-cache.devprod.cloudflare.dev --config=ci ${{ inputs.extra_bazel_args }} ${{ inputs.test_target }}
       - name: Upload coverage to Codecov
         if: inputs.run_coverage
         uses: codecov/codecov-action@v5
         with:
-          files: ./bazel-out/_coverage/_coverage_report.dat
+          # Use bazel info to get the actual output path, avoiding symlink issues
+          files: ${{ github.workspace }}/bazel-out/_coverage/_coverage_report.dat
           fail_ci_if_error: true
           verbose: true
+          disable_search: true
+          root_dir: ${{ github.workspace }}
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       - name: Parse headers

.github/workflows/test.yml

@@ -104,9 +104,12 @@ jobs:
       os_name: linux
       arch_name: 'X64'
       suffix: 'coverage'
+      # Don't use ci-test here because it enables --remote_download_minimal which prevents
+      # coverage data from being fetched from cache. The coverage config already sets
+      # --test_env=CI=true and --config=wpt-test which are the relevant parts of ci-test.
       # Use ci-linux-common instead of ci-linux to avoid overriding coverage test_tag_filters
       # (ci-linux sets test_tag_filters that would include container tests which require docker)
-      extra_bazel_args: '--config=ci-test --config=ci-linux-common --config=ci-limit-storage'
+      extra_bazel_args: '--config=ci-linux-common --config=ci-limit-storage --config=coverage'
       upload_test_logs: true
       upload_binary: false
       build_container_images: false

build/fixtures/kj_test.sh

@@ -1,3 +1,8 @@
 #!/bin/bash
 set -euo pipefail
-"$@"
+
+if [ -n "${COVERAGE_DIR:-}" ]; then
+    export LLVM_PROFILE_FILE="$COVERAGE_DIR/%p-%m.profraw"
+fi
+
+exec "$@"

build/kj_test.bzl

@@ -50,18 +50,20 @@ def kj_test(
 
     sh_test(
         name = test_name + "@",
-        size = size,
         srcs = ["//build/fixtures:kj_test.sh"],
-        data = [cross_alias] + data,
-        args = ["$(location " + cross_alias + ")"],
+        args = ["$(location {})".format(cross_alias)],
+        data = data + [cross_alias],
         tags = tags,
+        size = size,
     )
+
     sh_test(
         name = test_name + "@all-autogates",
-        size = size,
-        env = {"WORKERD_ALL_AUTOGATES": "1"},
         srcs = ["//build/fixtures:kj_test.sh"],
-        data = [cross_alias] + data,
-        args = ["$(location " + cross_alias + ")"],
-        tags = tags,
+        args = ["$(location {})".format(cross_alias)],
+        data = data + [cross_alias],
+        env = {"WORKERD_ALL_AUTOGATES": "1"},
+        # Tag with no-coverage to reduce coverage CI time
+        tags = tags + ["no-coverage"],
+        size = size,
     )

build/wd_cc_binary.bzl

@@ -47,6 +47,5 @@ def wd_cc_binary(
             "@//build/config:prebuilt_binaries_arm64": "@//:bin.arm64/tmp/{}/{}.aarch64-linux-gnu".format(pkg, prebuilt_binary_name),
             "//conditions:default": name,
         }),
-        # Propagate InstrumentedFilesInfo through the alias for coverage support
         testonly = kwargs.get("testonly", False),
     )

build/wd_rust_binary.bzl

@@ -54,10 +54,6 @@ def wd_rust_binary(
         visibility = visibility,
         data = data,
         proc_macro_deps = proc_macro_deps,
-        experimental_use_cc_common_link = select({
-            "@platforms//os:windows": 0,
-            "//conditions:default": 1,
-        }),
         target_compatible_with = select({
             "@//build/config:no_build": ["@platforms//:incompatible"],
             "//conditions:default": [],
@@ -74,10 +70,6 @@ def wd_rust_binary(
             # our tests are usually very heavy and do not support concurrent invocation
             "RUST_TEST_THREADS": "1",
         },
-        experimental_use_cc_common_link = select({
-            "@platforms//os:windows": 0,
-            "//conditions:default": 1,
-        }),
         target_compatible_with = select({
             "@//build/config:no_build": ["@platforms//:incompatible"],
             "//conditions:default": [],

build/wd_rust_crate.bzl

@@ -148,10 +148,6 @@ def wd_rust_crate(
         crate_features = crate_features,
         deps = test_deps,
         proc_macro_deps = test_proc_macro_deps,
-        experimental_use_cc_common_link = select({
-            "@platforms//os:windows": 0,
-            "//conditions:default": 1,
-        }),
     )
 
     if len(proc_macro_deps) + len(cxx_bridge_srcs) > 0:

build/wd_rust_proc_macro.bzl

@@ -47,8 +47,4 @@ def wd_rust_proc_macro(
         } | test_env,
         tags = test_tags,
         deps = test_deps,
-        experimental_use_cc_common_link = select({
-            "@platforms//os:windows": 0,
-            "//conditions:default": 1,
-        }),
     )

build/wd_test.bzl

@@ -132,12 +132,12 @@ set TEST_EXIT=!ERRORLEVEL!
 exit /b !TEST_EXIT!
 """
 
-SH_TEMPLATE = """#!/bin/sh
-set -e
+SH_TEMPLATE = """#!/bin/bash
+set -euo pipefail
 
 # Set up coverage for workerd subprocess
-if [ -n "$COVERAGE_DIR" ]; then
-    export LLVM_PROFILE_FILE="$COVERAGE_DIR/%p.profraw"
+if [ -n "${{COVERAGE_DIR:-}}" ]; then
+    export LLVM_PROFILE_FILE="${{COVERAGE_DIR}}/%p-%m.profraw"
     export KJ_CLEAN_SHUTDOWN=1
 fi
 
@@ -242,8 +242,6 @@ def _wd_test_impl(ctx):
         ctx,
         source_attributes = ["src", "data"],
         dependency_attributes = ["workerd", "sidecar", "sidecar_supervisor"],
-        # Include all file types that might contain testable code
-        extensions = ["cc", "c++", "cpp", "cxx", "c", "h", "hh", "hpp", "hxx", "inc", "js", "ts", "mjs", "wd-test", "capnp"],
     )
     environment = dict(ctx.attr.env)
     if ctx.attr.python_snapshot_test:
@@ -282,11 +280,14 @@ _wd_test = rule(
         ),
         # Source file
         "src": attr.label(allow_single_file = True),
-        # The workerd executable is used to run all tests
+        # The workerd executable is used to run all tests.
+        # Using cfg = "target" instead of "exec" ensures workerd is built with coverage
+        # instrumentation when running `bazel coverage`. With cfg = "exec", the binary
+        # would be built in exec configuration which doesn't include coverage flags.
         "workerd": attr.label(
             allow_single_file = True,
             executable = True,
-            cfg = "exec",
+            cfg = "target",
             default = "//src/workerd/server:workerd_cross",
         ),
         # A list of files that this test requires to be present in order to run.

justfile

@@ -143,7 +143,7 @@ eslint:
 
 # Generate code coverage report (Linux only)
 coverage path="//...":
-  bazel coverage {{path}}
+  bazel coverage --config=coverage {{path}}
   genhtml --branch-coverage --ignore-errors category --output coverage "$(bazel info output_path)/_coverage/_coverage_report.dat"
   open coverage/index.html
 

src/cloudflare/internal/test/d1/BUILD.bazel

@@ -12,7 +12,7 @@ wd_test(
 )
 
 wd_test(
-    size = "large",
+    size = "enormous",
     src = "d1-api-test-with-sessions.wd-test",
     args = ["--experimental"],
     data = glob(["*.js"]),

src/cloudflare/internal/test/images/BUILD.bazel

@@ -1,6 +1,9 @@
 load("//:build/wd_test.bzl", "wd_test")
 
 wd_test(
+    # Using size enormous because it takes a really long time executing it
+    # under coverage.
+    size = "enormous",
     src = "images-api-test.wd-test",
     args = ["--experimental"],
     data = glob(["*.js"]) + ["//src/cloudflare/internal/test:instrumentation-test-helper.js"],

src/workerd/api/tests/BUILD.bazel

@@ -121,16 +121,14 @@ wd_test(
 )
 
 wd_test(
-    size = "large",
+    size = "enormous",
     src = "sql-test.wd-test",
     args = ["--experimental"],
     data = [
         "instrumentation-tail-worker.js",
         "sql-test.js",
         "sql-test-tail.js",
     ],
-    # Exceeds 240s timeout under coverage instrumentation
-    tags = ["no-coverage"],
 )
 
 wd_test(

src/workerd/io/BUILD.bazel

@@ -416,6 +416,8 @@ kj_test(
 
 kj_test(
     src = "promise-wrapper-test.c++",
+    # Omitting coverage because it takes a really long time executing it.
+    tags = ["no-coverage"],
     deps = [
         ":io",
         ":promise-wrapper",

src/workerd/server/tests/python/py_wd_test.bzl

@@ -205,7 +205,9 @@ def py_wd_test(
         "--python-snapshot-dir",
         ".",
     ]
-    tags = tags + ["py_wd_test", "python"]
+
+    # Python tests are extremely slow with coverage instrumentation, skip them
+    tags = tags + ["py_wd_test", "python", "no-coverage"]
 
     for python_flag in python_flags:
         _py_wd_test_helper(

tools/BUILD.bazel

@@ -22,8 +22,7 @@ js_test(
     name = "custom-eslint-rules-test",
     size = "small",
     data = [
-        "custom-eslint-rules.mjs",
-        "//:node_modules/eslint",
+        ":base-eslint",
     ],
     entry_point = "custom-eslint-rules.test.mjs",
     tags = ["js-test"],