From 074c7e5f35bba5f7fe6bb0f6b96464655d34e6e1 Mon Sep 17 00:00:00 2001
From: Petr Toman <ptoman@redhat.com>
Date: Tue, 2 Jun 2026 15:18:03 +0200
Subject: [PATCH 1/2] feat: add Codecov integration with cargo-llvm-cov

- Add cargo-llvm-cov for coverage report generation
- Add push-to-main trigger (needed for Codecov baseline)
- Add Codecov upload step with OIDC auth and unit-tests flag
- Add codecov.yml with informational status checks and carryforward

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/_main.yaml | 22 ++++++++++++++++++++--
 codecov.yml                  | 23 +++++++++++++++++++++++
 2 files changed, 43 insertions(+), 2 deletions(-)
 create mode 100644 codecov.yml

diff --git a/.github/workflows/_main.yaml b/.github/workflows/_main.yaml
index cd65445..d1b93a4 100644
--- a/.github/workflows/_main.yaml
+++ b/.github/workflows/_main.yaml
@@ -1,6 +1,10 @@
 name: PR tests
 
 on:
+  push:
+    branches: ["main"]
+    paths-ignore:
+      - "**.md"
   pull_request:
     branches: ["main"]
     paths-ignore:
@@ -30,6 +34,8 @@ jobs:
 
   ci:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - name: Set up Rust
@@ -40,8 +46,20 @@ jobs:
         run: cargo check
       - name: Crate Clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
-      - name: Crate Test
-        run: cargo test
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-llvm-cov
+      - name: Install llvm-tools-preview
+        run: rustup component add llvm-tools-preview
+      - name: Crate Test with coverage
+        run: cargo llvm-cov --codecov --output-path codecov.json
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          flags: unit-tests
+          files: codecov.json
+          slug: guacsec/trustify-release-tools
 
   check-milestones:
     needs: build
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..52b185c
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,23 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+
+ignore:
+  - "pkg/config/**"
+
+flags:
+  unit-tests:
+    carryforward: true
+
+comment:
+  layout: "reach,diff,flags,files"
+  behavior: default

From ddd351f43d1e714b6a3f58f82ed5a52f32da3f6a Mon Sep 17 00:00:00 2001
From: Petr Toman <ptoman@redhat.com>
Date: Wed, 10 Jun 2026 13:01:09 +0200
Subject: [PATCH 2/2] fix: remove hardcoded Codecov slug

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/_main.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/_main.yaml b/.github/workflows/_main.yaml
index d1b93a4..bc06edf 100644
--- a/.github/workflows/_main.yaml
+++ b/.github/workflows/_main.yaml
@@ -59,7 +59,6 @@ jobs:
           use_oidc: true
           flags: unit-tests
           files: codecov.json
-          slug: guacsec/trustify-release-tools
 
   check-milestones:
     needs: build