ci: add code coverage check workflows

.github/workflows/codecov-upload.yml

@@ -0,0 +1,56 @@
+name: Codecov Upload
+
+on:
+  workflow_run:
+    workflows: ["PR Check"]
+    types: [completed]
+
+jobs:
+  upload-coverage:
+    name: Upload Coverage
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      actions: read
+
+    steps:
+      - name: Get PR info from triggering workflow
+        id: pr-info
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prs = context.payload.workflow_run.pull_requests;
+            if (!prs || prs.length === 0) {
+              core.setFailed('No pull request associated with this workflow run.');
+              return;
+            }
+            const pr = prs[0];
+            core.setOutput('pr_number', pr.number);
+            core.setOutput('head_sha', pr.head.sha);
+            core.setOutput('head_ref', pr.head.ref);
+            core.setOutput('run_id', context.payload.workflow_run.id);
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.pr-info.outputs.head_sha }}
+
+      - name: Download JaCoCo artifacts from PR Check
+        uses: actions/download-artifact@v4
+        with:
+          name: jacoco-rockylinux
+          path: artifacts/jacoco-rockylinux
+          run-id: ${{ steps.pr-info.outputs.run_id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          directory: artifacts/jacoco-rockylinux
+          override_commit: ${{ steps.pr-info.outputs.head_sha }}
+          override_branch: ${{ steps.pr-info.outputs.head_ref }}
+          override_pr: ${{ steps.pr-info.outputs.pr_number }}
+          fail_ci_if_error: true

codecov.yml

@@ -0,0 +1,11 @@
+comment: false
+
+coverage:
+  status:
+    project:
+      default:
+        target: auto    # must not decrease from base branch
+        threshold: 0.1% # allow 0.1% fluctuation
+    patch:
+      default:
+        target: 0%      # minimum coverage for changed lines