From 6a0e2fae07d9ae4ffd896db55a107f2d1a48e32a Mon Sep 17 00:00:00 2001
From: "Dylan M. Taylor" <dylan@dylanmtaylor.com>
Date: Fri, 13 Nov 2026 12:51:55 +0000
Subject: [PATCH] fix(sonar): fail after coverage generation errors

---
 .github/workflows/sonarcloud.yml | 6 ++++++
 tests/test_sonarcloud.py         | 9 +++++++++
 2 files changed, 15 insertions(+)

diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index 43eafac..4666084 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -785,6 +785,12 @@ jobs:
             -Dsonar.organization=storytold
             -Dsonar.rust.lcov.reportPaths=lcov.info
             "-Dsonar.cpd.exclusions=${{ steps.project.outputs.cpd }}"
+      - name: Fail on Rust coverage generation failure
+        if: steps.coverage.outcome == 'failure'
+        shell: bash
+        run: |
+          echo "::error::cargo llvm-cov failed to build the test archive or write lcov.info"
+          exit 1
       - name: Fail on JavaScript/TypeScript test failures
         if: steps.node-coverage.outputs.status != '' && steps.node-coverage.outputs.status != '0'
         env:
diff --git a/tests/test_sonarcloud.py b/tests/test_sonarcloud.py
index f2d1a83..230830c 100644
--- a/tests/test_sonarcloud.py
+++ b/tests/test_sonarcloud.py
@@ -126,6 +126,15 @@ class SonarCloudTests(unittest.TestCase):
         self.assertIn('--output-path lcov.info', coverage['run'])
         self.assertEqual(coverage['continue-on-error'], 'true')
 
+    def test_coverage_generation_failure_is_blocking_after_scan(self):
+        coverage = next(step for step in self.steps if step.get('id') == 'coverage')
+        failure = next(step for step in self.steps
+                       if step.get('name') == 'Fail on Rust coverage generation failure')
+        self.assertEqual(failure['if'], 'steps.coverage.outcome == \'failure\'')
+        self.assertGreater(self.steps.index(failure), self.steps.index(self.scan))
+        self.assertIn('cargo llvm-cov failed to build the test archive or write lcov.info', failure['run'])
+        self.assertTrue(coverage['continue-on-error'], 'the scan still runs to publish diagnostics')
+
     def test_coverage_actions_track_main_and_pin_external_actions(self):
         workflow = yaml.load(
             (ROOT / '.github/workflows/sonarcloud.yml').read_text(), Loader=yaml.BaseLoader)