feat(ci): P1-3 增量覆盖率门禁 - diff-cover接入+全量门槛提至65%

- 新增diff-cover增量行覆盖率检查，PR改动代码需>=60%覆盖率
- 增量测试模式下门槛调低至40%（覆盖不全）
- 全量覆盖率门槛从60%提升至65%（当前68%，留3%缓冲）
- 覆盖率不达标直接阻塞合并，倒逼新代码补单元测试

.gitea/workflows/ci-cd.yml

@@ -264,7 +264,51 @@ jobs:
         '
     - name: Run unit tests with coverage
       shell: sh
-      run: "set -eu\nPYTHONPATH=\"$PWD/apps/api:$PWD\" python3 -m coverage run \\\n  --source=apps/api/app,packages \\\n  --omit=\"*/migrations/*,*/tests/*,*/test_*.py,*/site-packages/*\" \\\n  --branch \\\n  -m pytest tests/unit -q\npython3 -m coverage report --show-missing\npython3 -m coverage xml -o coverage.xml\npython3 -m coverage report --fail-under=60 > /dev/null\n"
+      run: "set -eu\nPYTHONPATH=\"$PWD/apps/api:$PWD\" python3 -m coverage run \\\n  --source=apps/api/app,packages \\\n  --omit=\"*/migrations/*,*/tests/*,*/test_*.py,*/site-packages/*\" \\\n  --branch \\\n  -m pytest tests/unit -q\npython3 -m coverage report --show-missing\npython3 -m coverage xml -o coverage.xml\npython3 -m coverage report --fail-under=65 > /dev/null\n"
+    - name: Diff coverage check (增量行覆盖率)
+      if: github.event_name == 'pull_request'
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/||; s|/.*||')
+        
+        # 获取base分支
+        BASE_BRANCH="${{ github.base_ref }}"
+        echo "Base branch: $BASE_BRANCH"
+        
+        # 拉取base分支用于对比
+        git fetch origin $BASE_BRANCH --depth=100 2>/dev/null || true
+        
+        # 根据模式设置门槛
+        if [ "${UNIT_TEST_MODE:-full}" = "incremental" ]; then
+          # 增量测试模式覆盖不全，门槛设低一些
+          THRESHOLD=40
+          echo "增量测试模式，增量覆盖率门槛: ${THRESHOLD}%"
+        else
+          THRESHOLD=60
+          echo "全量测试模式，增量覆盖率门槛: ${THRESHOLD}%"
+        fi
+        
+        # 运行diff-cover
+        set +e
+        python3 -m diff_cover.diff_cover_tool coverage.xml           --compare-branch="origin/$BASE_BRANCH"           --fail-under=$THRESHOLD           --html-report diff_coverage.html           2>&1
+        DIFF_EXIT=$?
+        set -e
+        
+        if [ $DIFF_EXIT -ne 0 ]; then
+          echo ""
+          echo "❌ 增量覆盖率未达到门槛 (${THRESHOLD}%)"
+          echo "   请为改动的代码添加单元测试后再提交"
+          echo ""
+          echo "=== 覆盖率报告 ==="
+          python3 -m diff_cover.diff_cover_tool coverage.xml             --compare-branch="origin/$BASE_BRANCH" 2>&1 | tail -30
+          exit 1
+        fi
+        
+        echo "✅ 增量覆盖率达标"
+
     - name: CI failure notification
       if: failure()
       shell: sh

requirements-dev.txt

@@ -11,3 +11,4 @@ pytest==8.3.3
 pytest-asyncio==0.24.0
 pytest-cov==6.0.0
 pytest-timeout==2.3.1
+diff-cover>=8.0