From f9f7951859d55fa14978e704da8ea996e00cb268 Mon Sep 17 00:00:00 2001
From: alexander-akait <4567934+alexander-akait@users.noreply.github.com>
Date: Sun, 18 Oct 2026 21:07:34 +0000
Subject: [PATCH 1/2] ci: report coverage once every job has uploaded, and
 tolerate timing noise

Claude-Session: https://claude.ai/code/session_017TkBWTk3wcyUcJYDp5ZhaP
---
 .github/workflows/test.yml | 17 +++++++++++++++++
 codecov.yml                | 20 ++++++++++++++++++++
 2 files changed, 37 insertions(+)
 create mode 100644 codecov.yml

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6c8efb7..b84a6a0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -110,3 +110,20 @@ jobs:
         with:
           flags: integration
           token: ${{ secrets.CODECOV_TOKEN }}
+
+  coverage-notify:
+    needs: test
+    # A failed matrix job still gets a report from what did upload.
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Codecov
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          run_command: send-notifications
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..761a815
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,20 @@
+codecov:
+  branch: main
+  notify:
+    # Statuses and the comment wait for `coverage-notify` in test.yml, which
+    # runs once every matrix job has uploaded, not after the first few.
+    manual_trigger: true
+coverage:
+  precision: 2
+  round: down
+  range: "70...100"
+  status:
+    project:
+      default:
+        target: auto
+        # Which branch of a race a watcher test takes depends on the runner's
+        # timing, so the same code covers a few lines more or less run to run.
+        threshold: 0.5%
+    patch:
+      default:
+        target: auto

From e0b33907f7b4a24d663b3bcd4d5e5291b20a556f Mon Sep 17 00:00:00 2001
From: alexander-akait <4567934+alexander-akait@users.noreply.github.com>
Date: Sun, 18 Oct 2026 21:14:38 +0000
Subject: [PATCH 2/2] ci: give coverage-notify a read-only token

Claude-Session: https://claude.ai/code/session_017TkBWTk3wcyUcJYDp5ZhaP
---
 .github/workflows/test.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b84a6a0..c2af1c7 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -113,6 +113,8 @@ jobs:
 
   coverage-notify:
     needs: test
+    permissions:
+      contents: read
     # A failed matrix job still gets a report from what did upload.
     if: ${{ !cancelled() }}
     runs-on: ubuntu-latest