fix: change codecov configuration

Signed-off-by: mamoralesiob <miguelangel@io.builders>

Author: mamoralesiob

.github/workflows/100-flow-ats-test.yaml

@@ -8,6 +8,7 @@ on:
       - "packages/ats/**"
       - "apps/ats/**"
       - "package.json"
+      - "codecov.yml"
       - ".github/workflows/*ats*.yaml"
   workflow_dispatch:
 
@@ -17,6 +18,7 @@ defaults:
 
 permissions:
   contents: read
+  statuses: read # gate step reads the codecov/project commit status
 
 jobs:
   test-ats:
@@ -99,3 +101,33 @@ jobs:
       - name: Upload coverage report
         if: ${{ steps.generate_coverage.outcome == 'success' }}
         uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v5.4.0
+
+      # Codecov evaluates coverage server-side and posts the `codecov/project`
+      # commit status asynchronously, after the upload returns. This step waits
+      # for that status on the PR head commit and fails the job if coverage
+      # dropped versus the base branch's last uploaded report (target: auto +
+      # threshold: 0% in codecov.yml).
+      - name: Enforce coverage did not decrease
+        if: ${{ github.event_name == 'pull_request' && steps.generate_coverage.outcome == 'success' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REPO: ${{ github.repository }}
+        run: |
+          echo "Waiting for Codecov to post codecov/project for ${HEAD_SHA}..."
+          state=""
+          for attempt in $(seq 1 30); do
+            state=$(gh api "repos/${REPO}/commits/${HEAD_SHA}/statuses" \
+              --jq 'map(select(.context == "codecov/project")) | .[0].state // ""')
+            if [ -n "${state}" ] && [ "${state}" != "pending" ]; then
+              break
+            fi
+            echo "  attempt ${attempt}/30: state='${state:-<none>}' — retrying in 10s"
+            sleep 10
+          done
+          echo "Final codecov/project state: '${state:-<none>}'"
+          if [ "${state}" != "success" ]; then
+            echo "::error::Coverage decreased versus the base branch's last report (codecov/project='${state:-none/timed-out}')."
+            exit 1
+          fi
+          echo "✓ Coverage did not decrease"

codecov.yml

@@ -10,10 +10,13 @@ coverage:
       default:
         target: auto
         threshold: 0%
+        if_ci_failed: error
     project:
       default:
         target: auto
         threshold: 0%
+        if_ci_failed: error # don't report success if the test job itself failed
+        informational: false # blocking status, not advisory (this is the default — explicit here)
 
 ignore:
   - "packages/*/dist"