chore: Fail build if code coverage is too low

buildspec.yml

@@ -57,3 +57,6 @@ batch:
       buildspec: codebuild/py38/awses_2.0.0.yml
     - identifier: py38_awses_latest
       buildspec: codebuild/py38/awses_latest.yml
+
+    - identifier: code_coverage
+      buildspec: codebuild/coverage/coverage.yml

codebuild/coverage/coverage.yml

@@ -0,0 +1,14 @@
+version: 0.2
+
+env:
+  variables:
+    TOXENV: "coverage"
+
+phases:
+  install:
+    runtime-versions:
+      python: latest
+  build:
+    commands:
+      - pip install tox
+      - tox

setup.cfg

@@ -9,6 +9,7 @@ branch = True
 
 [coverage:report]
 show_missing = True
+fail_under = 95
 
 [tool:pytest]
 log_level = DEBUG

tox.ini

@@ -35,8 +35,12 @@ envlist =
 # test-release :: Builds dist files and uploads to testpypi pypirc profile.
 # release :: Builds dist files and uploads to pypi pypirc profile.
 
+# Reporting environments:
+#
+# coverage :: Runs code coverage, failing the build if coverage is below the configured threshold
+
 [testenv:base-command]
-commands = pytest --basetemp={envtmpdir} -l --cov aws_encryption_sdk {posargs}
+commands = pytest --basetemp={envtmpdir} -l {posargs}
 
 [testenv]
 passenv =
@@ -62,6 +66,10 @@ commands =
     all: {[testenv:base-command]commands} test/ examples/test/
     manual: {[testenv:base-command]commands}
 
+# Run code coverage on the unit tests
+[testenv:coverage]
+commands = {[testenv:base-command]commands} --cov aws_encryption_sdk test/ -m local
+
 # Verify that local tests work without environment variables present
 [testenv:nocmk]
 basepython = python3