ci: upload the coverage report to Codecov

.github/workflows/tests@v1.yml

@@ -493,6 +493,10 @@ jobs:
     if: ${{ !cancelled() }}
     continue-on-error: true
     timeout-minutes: 20
+    # continue-on-error reports this job to the jobs that need it as a success
+    # even when it failed, so the Codecov upload reads this instead.
+    outputs:
+      built: ${{ steps.aggregate.outcome == 'success' && steps.upload-report.outcome == 'success' }}
 
     # Only needs to read the checkout; same-run artifacts are handled by the
     # Actions runtime token rather than GITHUB_TOKEN. Scoped on this job alone
@@ -577,12 +581,56 @@ jobs:
           find . -name 'jacoco-*.exec' -printf '%p\t%s bytes\n'
 
       - name: Aggregate coverage
+        id: aggregate
         run: make coverage-report
 
       - name: Upload coverage report
+        id: upload-report
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ !cancelled() }}
         with:
           name: coverage-report
           path: coverage-report/target/site/jacoco-aggregate
           if-no-files-found: error
+
+  # A job of its own, without the report job's continue-on-error, so that a
+  # refused upload fails the run. Only a run in which every lane passed
+  # uploads: a partial report on scylla-4.x would become the baseline later
+  # pull requests are compared against. needs cannot tell a matrix's legs
+  # apart, so a failed JDK 11 leg, which records no coverage, holds the upload
+  # back as well. Pull requests from forks get no secrets and upload without a
+  # token; neither that nor a Dependabot run, which gets no CODECOV_TOKEN,
+  # fails on a refused upload.
+  codecov:
+    name: Upload coverage to Codecov
+    runs-on: ubuntu-latest
+    needs: [unit-tests, cassandra-integration-tests, scylla-integration-tests, coverage-report]
+    if: >-
+      needs.unit-tests.result == 'success' &&
+      needs.cassandra-integration-tests.result == 'success' &&
+      needs.scylla-integration-tests.result == 'success' &&
+      needs.coverage-report.outputs.built == 'true'
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      # Codecov matches jacoco.xml's paths against the checkout's file list.
+      - name: Checkout source
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          persist-credentials: false
+
+      - name: Download coverage report
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: coverage-report
+          path: coverage-report
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: coverage-report/jacoco.xml
+          disable_search: true
+          fail_ci_if_error: ${{ github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }}

README-dev.md

@@ -79,6 +79,10 @@ as an artifact. That job is `continue-on-error`, so a flaky integration test cos
 data rather than adding a second failure to the pull request. Collecting from the existing lanes
 rather than a dedicated workflow keeps the Scylla suite from being run twice.
 
+When every test lane passed, the next job uploads that `jacoco.xml` to
+[Codecov](https://codecov.io/gh/scylladb/java-driver), which comments the coverage delta on the
+pull request. Its statuses are informational, so a drop never blocks a merge.
+
 Only the lanes on `COVERAGE_JAVA_VERSION` (a workflow-level variable, JDK 17) are instrumented.
 javac 11 and javac 17 do not emit the same bytes for the same source even under `--release 11` --
 they order the constant pool differently -- so the class ids differ, and a report rendered against

README.md

@@ -1,6 +1,7 @@
 # Java Driver for Scylla and Apache Cassandra®
 
 [![Maven Central](https://img.shields.io/maven-central/v/com.scylladb/java-driver-core)](https://central.sonatype.com/artifact/com.scylladb/java-driver-core)
+[![Codecov](https://codecov.io/gh/scylladb/java-driver/branch/scylla-4.x/graph/badge.svg)](https://codecov.io/gh/scylladb/java-driver)
 
 *If you're reading this on github.com, please note that this is the readme for the development 
 version and that some features described here might not yet have been released. You can find the

codecov.yml

@@ -0,0 +1,36 @@
+# Codecov configuration for the upload in the "Coverage report" job of
+# .github/workflows/tests@v1.yml.
+# Reference: https://docs.codecov.com/docs/codecov-yaml
+#
+# There are no path fixes: each package/sourcefile pair in jacoco.xml names
+# exactly one file, e.g. com/datastax/oss/driver/api/core/CqlSession.java can
+# only be core/src/main/java/com/datastax/oss/driver/api/core/CqlSession.java.
+
+codecov:
+  # That job is the only uploader, so its report should neither be withheld
+  # because an unrelated check (Full verify, say) failed nor wait for it.
+  require_ci_to_pass: false
+  notify:
+    wait_for_ci: false
+  # Codecov discards a JaCoCo report whose oldest session is from before noon
+  # the previous day. "Re-run failed jobs" keeps the lanes that passed, so a
+  # re-run's report still carries their first-attempt sessions, and a re-run
+  # after a weekend would be discarded although it is built from this run's
+  # own lanes.
+  max_report_age: false
+
+coverage:
+  status:
+    # Informational: report the delta, never fail a pull request on it. The
+    # integration suites run against live Scylla and Cassandra clusters, so
+    # which lines they reach depends on cluster timing as well as on the diff.
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+    patch:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true