ci(.github/workflows): enable Codecov coverage reporting

Add .codecov.yaml with coverage thresholds and an ignore list for
non-source directories, following the same change made in tekton
pruner. Upload coverage to Codecov via OIDC alongside the
existing artifact upload and PR-comment step.

Signed-off-by: Emil Natan <ena@redhat.com>
Assisted-by: Claude Sonnet 5 (via Claude Code)

Author: enarha

.codecov.yaml

@@ -0,0 +1,31 @@
+coverage:
+  # Commit status https://docs.codecov.io/docs/commit-status are used
+  # to block PR based on coverage threshold.
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 5%
+    patch:
+      # Disable the coverage threshold of the patch, so that PRs are
+      # only failing because of overall project coverage threshold.
+      # See https://docs.codecov.io/docs/commit-status#disabling-a-status.
+      default: false
+
+ignore:
+  # Auto-generated client code.
+  - "pkg/client/clientset/**"
+  - "pkg/client/informers/**"
+  - "pkg/client/listers/**"
+  - "pkg/client/injection/**"
+  # Auto-generated deepcopy/openapi code.
+  - "pkg/apis/config/zz_generated.deepcopy.go"
+  - "pkg/apis/triggers/v1alpha1/zz_generated.deepcopy.go"
+  - "pkg/apis/triggers/v1beta1/zz_generated.deepcopy.go"
+  - "pkg/apis/triggers/v1beta1/openapi_generated.go"
+  - "hack/**"
+  - "test/**"
+  - "config/**"
+  - "tekton/**"
+  - "docs/**"
+  - "vendor/**"

.github/workflows/go-coverage.yml

@@ -27,6 +27,7 @@ jobs:
     runs-on: ubuntu-24.04
     permissions:
       pull-requests: write # Required by go-coverage-report to comment on PRs
+      id-token: write # Required to upload coverage to Codecov via OIDC
 
     steps:
       - name: Harden runner
@@ -48,19 +49,28 @@ jobs:
       - name: Generate coverage
         working-directory: ${{ github.workspace }}/src/github.com/tektoncd/triggers
         run: |
-          go test -cover -coverprofile=coverage.txt ./... || true
+          go test -coverprofile=coverage.out -covermode=atomic ./... || true
           echo "Generated coverage profile"
 
       - name: Archive coverage results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: code-coverage
-          path: ${{ github.workspace }}/src/github.com/tektoncd/triggers/coverage.txt
+          path: ${{ github.workspace }}/src/github.com/tektoncd/triggers/coverage.out
 
       - name: Comment on PR
         if: github.event_name == 'pull_request'
         uses: fgrosse/go-coverage-report@cbeb2ab2e32591d690337146ba02a911cc566f3f # v1.3.0
         continue-on-error: true # This may fail if artifact on main branch does not exist (first run or expired)
         with:
           coverage-artifact-name: "code-coverage"
-          coverage-file-name: "coverage.txt"
+          coverage-file-name: "coverage.out"
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
+        continue-on-error: true # job still "succeeds" even if this step fails
+        with:
+          files: ${{ github.workspace }}/src/github.com/tektoncd/triggers/coverage.out
+          flags: unit-tests
+          use_oidc: true
+          fail_ci_if_error: false