ci: publish Rust coverage to Codecov

[jeremi]

Pull Request

Summary

Integrate Codecov with the Rust coverage surfaces while keeping expensive coverage instrumentation off the pull-request path:

• preserve the existing platform 80% line gate and export its collected data as LCOV
• run PostgreSQL 16, 17, and 18 Notary conformance without coverage instrumentation on pull requests and merge queue candidates
• retain instrumented Notary PostgreSQL coverage and Codecov uploads on pushes to main and manual runs
• group reports under platform and notary-postgres flags with carryforward enabled
• publish flag-specific project and patch statuses in informational mode, with unrelated flags excluded

Uploads use Codecov Action v7.0.0 pinned to commit fb8b3582c8e4def4969c97caa2f19720cb33a72f, Codecov CLI v11.3.1, explicit report paths, and OIDC authentication. OIDC permission is scoped to the main/manual coverage job; pull-request conformance retains read-only repository permissions.

Impact

This does not add another Rust build or test pass to pull requests. Platform LCOV export took about 0.2 seconds and the verified Codecov download/upload step took about 2.2 seconds in the initial run. Notary pull-request conformance no longer installs cargo-llvm-cov, compiles with coverage instrumentation, produces LCOV, or uploads coverage.

Comprehensive cross-workspace coverage is intentionally left for a follow-up nightly workflow so it does not consume the pull-request critical path.

Checks

• actionlint
• python3 .github/scripts/test_ci_changes.py
• Codecov configuration validation via POST https://api.codecov.io/validate
• cargo llvm-cov --locked -p registry-config-report -p 'registry-platform-*' --all-features --fail-under-lines 80
  • passed at 91.75% line coverage
• cargo llvm-cov report --locked -p registry-config-report -p 'registry-platform-*' --lcov --output-path target/platform-coverage/platform.lcov
  • produced a non-empty 34,854-line LCOV report
• uninstrumented PostgreSQL 18 Notary conformance, including typed state contracts, multi-instance recovery, minor upgrade, and logical backup/restore
• git diff --check

Before splitting the PR path, GitHub Actions verified that the platform report and PostgreSQL 16, 17, and 18 reports were all accepted and merged by Codecov under OIDC. Initial flag baselines were platform 92.06% and PostgreSQL-only Notary 20.13%.

Notes

• Owning area: CI configuration (.github/workflows and root codecov.yml).
• Fork pull requests do not receive OIDC permission from the coverage job because that job is skipped for pull-request events.
• Global aggregate statuses are disabled because these are intentionally partial Rust coverage surfaces. Flag-specific statuses remain informational until maintainers choose stable thresholds.
• No CODECOV_TOKEN secret is required.

DCO

• Every commit includes a Signed-off-by trailer.
• I reviewed the submitted changes and am responsible for the contribution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 12cd2be58c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 884396fa52

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".