ci: add Codecov coverage reporting

[hasansezertasan]

Description

Publishes test coverage to Codecov.

The coverage plumbing already existed — test.yaml produces coverage.xml (on the 3.11 matrix leg) and uploads it as the coverage-xml artifact, which the sonar job already consumes. This PR adds a codecov job that mirrors that pattern: download the artifact, upload via codecov/codecov-action@v5. No changes to the reusable test workflow, and no duplicated test run.

Also adds:

• codecov.yml — target: auto with a 0.1% project threshold, patch coverage, and require_changes: true on PR comments (from Litestarification #16).
• Coverage badge in the README Quality row.

Notes for reviewers

• Requires a CODECOV_TOKEN repo/org secret. For public repos codecov-action@v5 also supports tokenless upload from Actions, so this won't hard-fail without it.
• fail_ci_if_error: false — a Codecov outage won't red-X the build.

Closes

• Closes ci: add Codecov coverage reporting #24

Summary by Sourcery

Integrate Codecov coverage reporting into the CI pipeline and surface coverage status in project documentation.

CI:

• Add a dedicated Codecov job to the GitHub Actions CI workflow that uploads coverage.xml using codecov/codecov-action.
• Configure Codecov behavior to use automatic targets, a small project threshold, patch coverage tracking, and require changes for PR comments.

Documentation:

• Add a Codecov coverage badge to the README quality section alongside existing SonarCloud badges.

Chores:

• Introduce a codecov.yml configuration file to control coverage status thresholds and comment behavior.

---

⚠️ Stacked on #39. This PR is based on the ci/zizmor branch, not main, because both edit .github/workflows/ci.yaml. Merge #39 first; GitHub will then auto-retarget this PR to main. The codecov job uses a SHA-pinned codecov/codecov-action@0fb7174 # v5, persist-credentials: false, and a least-privilege permissions block so it passes #39's zizmor gate.

[sourcery-ai]

Reviewer's Guide

Adds a dedicated Codecov reporting job to the CI pipeline, configures repository-wide Codecov behavior, and surfaces coverage via a new README badge, all while reusing existing coverage artifacts and avoiding extra test runs.

File-Level Changes

Change	Details	Files
Introduce a Codecov upload job to the main CI workflow that consumes the existing coverage artifact without rerunning tests.	Add a codecov job that depends on test and validate, runs on ubuntu-latest, and checks out the repository. Download the pre-existing coverage-xml artifact produced by the test workflow. Upload coverage.xml to Codecov using codecov/codecov-action@v5 with an optional CODECOV_TOKEN secret and fail_ci_if_error set to false to avoid failing CI on Codecov outages.	.github/workflows/ci.yaml
Expose Codecov coverage information in project documentation via a README badge.	Extend the Quality row in the README status table with a Codecov coverage badge linking to the project’s Codecov page while retaining existing SonarCloud badges.	README.md
Configure global Codecov behavior for project and patch coverage thresholds and PR comment requirements.	Add a codecov.yml configuration that sets automatic targets for project and patch coverage, a 0.1% project threshold, and requires code changes before posting PR comments.	codecov.yml

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#24	Configure CI to upload test coverage (coverage.xml) to Codecov using codecov/codecov-action.	✅
#24	Add a Codecov configuration file (codecov.yml) defining coverage targets and thresholds.	✅
#24	Add a Codecov coverage badge to README.md.	✅

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• The codecov job downloads the coverage-xml artifact without specifying a path, so if coverage.xml is not at the workflow’s working directory root you may need to align the upload path with how the artifact is currently structured.
• Consider gating the Codecov upload step with an if condition based on secrets.CODECOV_TOKEN or repository visibility, so that private repos without a token don’t silently skip uploads in a non-obvious way.
• Review whether codecov truly needs to depend on validate in addition to test; if not, dropping the extra dependency can reduce unnecessary serialization of CI jobs.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The `codecov` job downloads the `coverage-xml` artifact without specifying a `path`, so if `coverage.xml` is not at the workflow’s working directory root you may need to align the upload path with how the artifact is currently structured.
- Consider gating the Codecov upload step with an `if` condition based on `secrets.CODECOV_TOKEN` or repository visibility, so that private repos without a token don’t silently skip uploads in a non-obvious way.
- Review whether `codecov` truly needs to depend on `validate` in addition to `test`; if not, dropping the extra dependency can reduce unnecessary serialization of CI jobs.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}