ci: add codecov configuration

[ralphbean]

Summary

• Adds .codecov.yml with standard coverage settings
• Project coverage target: auto (threshold: 1%)
• Patch coverage target: 80% (threshold: 5%)
• Ignores non-code files: docs, hack, experiments, images, markdown, shell scripts, test files, testdata
• Adds coverage profile generation and Codecov upload step to CI workflow

Supersedes #2064 (rebased from fork to upstream with fixes applied).

Original PR by @eedri.

🤖 Generated with Claude Code

[github-actions]

Site preview

Preview: https://61dae297-site.fullsend-ai.workers.dev

Commit: a30c11274efa3dd5fefc706637038d2dd36a45d3

[fullsend-ai-review]

🤖 Review · Started 11:58 AM UTC
Commit: ba204cb · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:02 PM UTC · Completed 12:10 PM UTC
Commit: ba204cb · View workflow run →

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment

Thanks for integrating Codecov - We've got you covered ☂️

[fullsend-ai-review]

Review

Findings

High

• [protected-path] .github/workflows/lint.yml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue justifying the modification of governance/infrastructure files.
  Remediation: Link an issue authorizing the CI workflow change, or obtain explicit human approval for the protected-path modification.

Low

• [supply-chain] .github/workflows/lint.yml:49 — The codecov/codecov-action is referenced by mutable major-version tag (@v5) rather than a full commit SHA. This follows the existing convention in the workflow (actions/setup-go@v5, actions/setup-node@v6 also use major-version tags), but SHA pinning is best practice. Risk is mitigated by the workflow's read-only permissions (contents: read).

• [missing-authorization] .codecov.yml — This PR adds Codecov integration (a third-party SaaS service) without a linked issue. The PR body and title clearly describe intent and reference superseded PR ci: add codecov configuration #2064, but no formal issue captures the decision to adopt Codecov.

• [workflow-coherence] .github/workflows/lint.yml — The workflow now runs go test -race -coverprofile=coverage.out ./... directly instead of calling make go-test (which runs go test -race -cover ./...). The commands differ only in that the CI version writes a coverage profile file; the env var handling is equivalent. This creates a minor maintenance concern: future changes to the go-test target won't automatically propagate to CI. Consider adding a make go-test-coverage Makefile target.

Previous run

Review

Findings

High

• [protected-path] .github/workflows/lint.yml — This PR modifies a file under .github/, which is a protected path requiring human approval. The PR has no linked issue justifying the modification of governance/infrastructure files. Human review is required regardless of code quality.
  Remediation: Link an issue authorizing the CI workflow change, or obtain explicit human approval for the protected-path modification.

Medium

• [missing-authorization] .codecov.yml — This PR adds Codecov integration (a third-party SaaS service) without a linked issue authorizing the change. Adding external service integration is a non-trivial architectural change that affects data flows and introduces a new dependency. The PR references superseded PR ci: add codecov configuration #2064, but no issue captures the authorization decision.
  Remediation: Create a GitHub issue documenting the decision to integrate Codecov, including justification and data residency considerations. Consider whether this warrants an ADR given the project's practice of documenting third-party integration decisions.

Low

• [supply-chain] .github/workflows/lint.yml:49 — The codecov/codecov-action is referenced by mutable major-version tag (@v5) rather than a full commit SHA. This follows the existing convention in the workflow (all other actions also use version tags), but SHA pinning is best practice. Risk is mitigated by the workflow's read-only permissions (contents: read).

• [redundant-execution] .github/workflows/lint.yml:43 — Go tests are executed twice in the same job: first via make test (which runs go test -race -cover ./...) and then via the explicit go test -race -coverprofile=coverage.out ./... step. The only difference is that the first produces a coverage summary while the second writes a profile file. This doubles Go test execution time.

• [undocumented-threshold] .codecov.yml — Coverage thresholds (80% patch target, auto project target) are set while docs/problems/repo-readiness.md explicitly lists coverage thresholds as an open design question. This configuration implicitly answers that question without updating the document.

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] supply-chain

The codecov/codecov-action is referenced by mutable major-version tag (@v5) rather than a full commit SHA. Follows existing repo convention but SHA pinning is best practice. Risk mitigated by read-only permissions.

Suggested fix: Pin the action to a specific commit SHA and use Dependabot or Renovate to keep the pin up to date.

[fullsend-ai-review]

[low] redundant-execution

Go tests are executed twice in the same job: first via make test (go test -race -cover) then again via go test -race -coverprofile=coverage.out. This doubles Go test execution time.

Suggested fix: Modify the Makefile go-test target to accept a COVERPROFILE variable, or remove the make test step since the coverage step runs the same tests.

[rh-hemartin]

Fix the redundant execution of tests.

[eedri]

just making sure you're OK with failing CI if patch coverage is below 80%, we can also set it to false to give a warning as well to start with.

[ralphbean]

Pushed a30c112. Splits make test into its three components (make lint-all, go test -coverprofile=..., make script-test) so Go tests only run once.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:16 PM UTC · Completed 9:24 PM UTC
Commit: a30c112 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[low] supply-chain

The codecov/codecov-action is referenced by mutable major-version tag (@v5) rather than a full commit SHA. This follows the existing convention in the workflow, but SHA pinning is best practice. Risk is mitigated by read-only permissions.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:13 PM UTC · Completed 12:18 PM UTC
Commit: a30c112 · View workflow run →

[fullsend-ai-retro]

Retro: PR #2069 — ci: add codecov configuration

Workflow quality: Good overall. The review agent correctly identified the redundant test execution issue (Go tests running twice), which the human reviewer (rh-hemartin) independently flagged — validating the agent's review quality on this PR.

Main friction point: After the author fixed the redundant execution, the review agent's second pass still issued CHANGES_REQUESTED with only LOW-severity findings remaining (supply-chain SHA pinning, missing issue linkage, workflow coherence) plus the governance-level protected-path HIGH. This forced the human reviewer to override the bot's blocking verdict. This pattern is extensively tracked — at least 16 open issues cover verdict calibration (#2115, #2057, #2029, #1068, #1942, #1500, etc.) and 13+ cover protected-path behavior on human PRs (#1551, #1392, #1508, #1583, #1597).

No new proposals filed. All identified improvement areas have substantial existing issue coverage:

• Verdict calibration (CHANGES_REQUESTED → COMMENT for low-severity re-reviews): Review agent: use COMMENT verdict for re-reviews with only low-severity findings #2029, Review agent: use COMMENT verdict for human-authored PRs with only medium/low findings #2115
• Protected-path on human PRs: Review agent: downgrade protected-path severity for human-authored PRs #1551, Protected-path finding should use COMMENT not CHANGES_REQUESTED when change is contextually justified #1508, Review agent should not file CHANGES_REQUESTED for governance-only findings that the fix agent cannot resolve #1068
• Re-review not downgrading verdict after fixes: Review agent should not re-request changes for unchanged findings #1500, Review bot should not override human approval with stale findings #1922
• Supply chain SHA pinning: Only 2 tangentially related issues, but the finding itself is low-impact and follows existing repo conventions

The 2-day time-to-merge was driven by human review cycles (timezone handoffs between ralphbean, rh-hemartin, and eedri), not agent overhead. Token cost was reasonable — 2 successful review runs plus 1 cancelled (superseded by push).