ci: onboard Codecov for unit test coverage tracking

- Add Codecov upload step with OIDC auth and unit-tests flag
- Add permissions: id-token: write for OIDC token
- Add codecov.yml with informational status checks and carryforward
- Scope coverage to hand-written source via existing JaCoCo config

Ref: COVERPORT-253

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ptomanRH

.github/workflows/pr.yml

@@ -13,6 +13,7 @@ jobs:
     permissions:
       checks: write
       pull-requests: write
+      id-token: write
     env:
       MAIN_JAVA_VER: 21
       RUN_PYTHON_BIN: ${{ vars.RUN_PYTHON_BIN }}
@@ -66,9 +67,11 @@ jobs:
           ./target/surefire-reports/*.xml
           ./target/junit-platform/TEST-junit-jupiter.xml
 
-    - name: Upload coverage reports
+    - name: Upload coverage to Codecov
       if: ${{ matrix.java == env.MAIN_JAVA_VER }}
-      uses: actions/upload-artifact@v7
+      uses: codecov/codecov-action@v5
       with:
-        name: coverage-${{ matrix.java }}
-        path: ./target/site/jacoco/jacoco.xml
+        use_oidc: true
+        flags: unit-tests
+        files: ./target/site/jacoco/jacoco.xml
+        slug: guacsec/trustify-da-java-client

codecov.yml

@@ -0,0 +1,31 @@
+codecov:
+  require_ci_to_pass: false
+
+comment:
+  layout: "reach,diff,flags,components"
+  behavior: default
+  require_changes: false
+  require_base: false
+  require_head: true
+  hide_project_coverage: false
+
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
+
+flags:
+  unit-tests:
+    paths:
+      - src/main/java/
+    carryforward: true
+
+ignore:
+  - "src/test/"
+  - "src/main/resources/"
+  - "target/"
+  - "docs/"