From 613e4750fb5ef141b78b45aac7c55771edf74d5f Mon Sep 17 00:00:00 2001
From: Karn <mail@karngyan.com>
Date: Thu, 20 Aug 2026 00:28:52 +0530
Subject: [PATCH] ci: upload Go coverage to Codecov

test-go gains a GOTESTFLAGS passthrough so CI can ask for a coverage
profile without changing the local default. The upload authenticates
over GitHub OIDC, so no CODECOV_TOKEN secret is needed for this public
repo, and a Codecov outage cannot fail the build.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/ci.yml | 13 ++++++++++++-
 .gitignore               |  3 +++
 Makefile                 |  2 +-
 README.md                |  1 +
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e9d8892..a12d941 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,8 +5,11 @@ on:
     branches: [main]
   pull_request:
 
+# id-token lets the Codecov upload authenticate over GitHub OIDC, so a
+# public-repo upload needs no CODECOV_TOKEN secret.
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   checks:
@@ -35,7 +38,15 @@ jobs:
       # of both `lint` and `test`, and a single invocation runs it once where
       # two separate steps built the frontend twice.
       - name: Lint and test
-        run: make lint test
+        run: make lint test GOTESTFLAGS="-coverprofile=coverage.out -covermode=atomic"
+
+      # fail_ci_if_error stays at its default (false): a Codecov outage must
+      # not fail the build, the same bar the shellcheck guard below holds.
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: coverage.out
+          use_oidc: true
 
       # ubuntu-latest images ship shellcheck, so this step normally does
       # nothing. The guard is what keeps it honest: the unconditional
diff --git a/.gitignore b/.gitignore
index 28d187c..5ec8bd2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,6 @@ flued
 /site/.wrangler/
 # tsc --noEmit with incremental drops this beside web/tsconfig.json.
 web/tsconfig.tsbuildinfo
+# `make test-go GOTESTFLAGS=-coverprofile=coverage.out` drops this at the
+# root; CI uploads it to Codecov.
+coverage.out
diff --git a/Makefile b/Makefile
index d1e08fa..f15290a 100644
--- a/Makefile
+++ b/Makefile
@@ -57,7 +57,7 @@ web-dev:
 test: test-go test-web test-relay
 
 test-go: web relay
-	go test ./...
+	go test $(GOTESTFLAGS) ./...
 
 test-web:
 	cd web && pnpm test
diff --git a/README.md b/README.md
index f5ad50c..0f8556c 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,7 @@
 
 <p align="center">
   <a href="https://github.com/karnstack/flue/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/karnstack/flue/ci.yml?branch=main&label=ci" alt="CI status"></a>
+  <a href="https://codecov.io/gh/karnstack/flue"><img src="https://codecov.io/gh/karnstack/flue/graph/badge.svg" alt="Coverage"></a>
   <a href="https://github.com/karnstack/flue/releases/latest"><img src="https://img.shields.io/github/v/release/karnstack/flue?label=release" alt="Latest release"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue" alt="MIT license"></a>
 </p>