For DevOps teams that gate merges and releases on evidence, not on a green that means nothing ran.
Add one flag to the run you already do. The unit and integration commands both take it.
UNITAUTOGEN_DSN or the PG* variables.--report to the default command, or to integration, and every CI report format lands in the --out folder:unitautogen --schema public --report --out ci_out
# ci_out/ report.html report.json junit.xml cobertura.xml coverage.lcov
psql or pg_prove aloneStandard formats, so nothing needs a custom parser.
junit.xml, which most CI test panels read directly.cobertura.xml or coverage.lcov, so Codecov, Coveralls and genhtml plot it and enforce your threshold on the pull request.report.html, kept as a build artifact, with one row per routine and the uncovered lines explained.report.json, one entry per routine, for a custom badge or a policy check.A build that proves nothing should not go green. These are the exit codes to wire to a required check.
seccover --sec-gate, exits 4A GitHub Action that runs on every pull request looks like this, and the same shape fits GitLab CI, Azure Pipelines or Jenkins.
jobs:
db-tests:
steps:
- run: unitautogen --schema public --report --out ci_out
- run: unitautogen seccover --schema public --sec-gate # exits 4 on a leak
- uses: actions/upload-artifact@v4 # keep report.html
with: { path: ci_out/report.html }
- uses: codecov/codecov-action@v4 # coverage.lcov -> the PR
with: { files: ci_out/coverage.lcov }
--report on every push, one commandseccover --sec-gate so a leak blocks the shipRunning your database tests in CI is what the platform tells you to do.