chore: Fail build if code coverage is too low

buildspec.yml

@@ -13,3 +13,6 @@ batch:
       buildspec: codebuild/python3.7.yml
     - identifier: python3_8
       buildspec: codebuild/python3.8.yml
+
+    - identifier: code_coverage
+      buildspec: codebuild/coverage/coverage.yml

codebuild/coverage/coverage.yml

@@ -0,0 +1,14 @@
+version: 0.2
+
+env:
+  variables:
+    TOXENV: "coverage"
+
+phases:
+  install:
+    runtime-versions:
+      python: latest
+  build:
+    commands:
+      - pip install tox
+      - tox

setup.cfg

@@ -9,6 +9,7 @@ branch = True
 
 [coverage:report]
 show_missing = True
+fail_under = 90
 
 [mypy]
 ignore_missing_imports = True

tox.ini

@@ -35,8 +35,12 @@ envlist =
 # test-release :: Builds dist files and uploads to testpypi pypirc profile.
 # release :: Builds dist files and uploads to pypi pypirc profile.
 
+# Reporting environments:
+#
+# coverage :: Runs code coverage, failing the build if coverage is below the configured threshold
+
 [testenv:base-command]
-commands = pytest --basetemp={envtmpdir} -l --cov dynamodb_encryption_sdk {posargs}
+commands = pytest --basetemp={envtmpdir} -l {posargs}
 
 [testenv]
 passenv =
@@ -86,6 +90,10 @@ commands =
     # Only run examples tests
     examples: {[testenv:base-command]commands} examples/test/ -m "examples"
 
+# Run code coverage on the unit tests
+[testenv:coverage]
+commands = {[testenv:base-command]commands} --cov dynamodb_encryption_sdk test/ -m "local and not slow and not veryslow and not nope"
+
 # Verify that local tests work without environment variables present
 [testenv:nocmk]
 basepython = python3