From ea916536396ac4ab9dd2fb2e125e396db7922a53 Mon Sep 17 00:00:00 2001
From: Juliano Martinez <juliano@martinez.io>
Date: Mon, 11 May 2026 22:34:04 +0200
Subject: [PATCH 1/2] ci: upload kcov coverage to Codecov and add badge

The CI already runs kcov via `zig build test-coverage` and merges the
reports into `zig-out/coverage/merged/`. Forward the resulting
cobertura.xml to Codecov so coverage is tracked over time, and surface
the badge in the README.
---
 .github/workflows/ci.yml | 7 +++++++
 README.md                | 1 +
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9281dc69..bc22031e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,6 +72,13 @@ jobs:
       - name: Coverage
         run: zig build test-coverage -Duse-llvm=true -Dcoverage-threshold=85
 
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: zig-out/coverage/merged/cobertura.xml
+          fail_ci_if_error: false
+
       - name: Valgrind leak checks
         run: zig build test-valgrind -Duse-llvm=true
 
diff --git a/README.md b/README.md
index f0455bae..322b93c7 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # yaml
 
 [![CI](https://github.com/ncode/yaml/actions/workflows/ci.yml/badge.svg)](https://github.com/ncode/yaml/actions/workflows/ci.yml)
+[![codecov](https://codecov.io/gh/ncode/yaml/graph/badge.svg?token=97Q2MPTNBJ)](https://codecov.io/gh/ncode/yaml)
 
 Native Zig YAML 1.2.2 library.
 

From 5055e2ae17562afc93ab9b06b43f33ba0de770c5 Mon Sep 17 00:00:00 2001
From: Juliano Martinez <juliano@martinez.io>
Date: Mon, 11 May 2026 22:37:12 +0200
Subject: [PATCH 2/2] ci: install gnupg so codecov-action can verify the
 uploader

codecov/codecov-action@v5 verifies the uploader binary's GPG signature
before running it. The debian:trixie-slim container we run the job in
doesn't ship gpg, so the action fails with "required dependencies are
missing: gpg". Add gnupg to the apt-get install list.
---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc22031e..1cf2cbdb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,8 @@ jobs:
           apt-get update
           apt-get install -y --no-install-recommends \
             kcov valgrind \
-            git ca-certificates curl xz-utils
+            git ca-certificates curl xz-utils \
+            gnupg
 
       - name: Checkout
         uses: actions/checkout@v4