Add Codecov CI upload and project configuration

.codecov.yml

@@ -0,0 +1,37 @@
+---
+codecov:
+  notify:
+    after_n_builds: 1
+    require_ci_to_pass: false
+
+coverage:
+  precision: 2
+  round: down
+  range: 50..75
+
+  status:
+    project:
+      default:
+        enabled: true
+        target: 70%
+        threshold: 1%
+        if_not_found: success
+        if_no_uploads: success
+        if_ci_failed: error
+    patch:
+      default:
+        enabled: true
+        target: 80%
+        if_not_found: success
+        if_no_uploads: success
+        if_ci_failed: error
+    changes: false
+
+comment:
+  layout: "header, diff"
+  behavior: default
+  require_changes: false
+
+ignore:
+  - "**/zz_generated.*.go"
+  - "**/applyconfiguration/**"

.github/workflows/codecov.yaml

@@ -0,0 +1,38 @@
+name: Codecov
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  codecov:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        with:
+          go-version-file: go.mod
+
+      - name: Run unit tests with coverage
+        run: |
+          go mod tidy
+          make test
+
+      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        with:
+          files: ./cover.out

site-src/contributing/index.md

@@ -21,6 +21,7 @@ From the repository root:
 - **Lint / vet:** `make lint`
 - **Tests:** `make test` (writes `cover.out` for coverage)
 - **Test coverage:** `make test` writes `cover.out`. Run `make test-cover` to refresh tests and emit `out/coverage.html` and `out/coverage.txt` (`go tool cover`). With `cover.out` present, `make cover-func` prints a per-function summary and `make cover-html` opens the interactive HTML report in a browser (local). Remove generated artifacts with `make cover-clean`.
+- **CI coverage:** Pull requests and pushes to `main` upload `cover.out` to [Codecov](https://codecov.io/gh/kubernetes-sigs/mcp-lifecycle-operator). Codecov enforces a minimum project coverage of 70% (with 1% slack) and 80% coverage on changed lines in each PR.
 - **Generate manifests:** `make manifests generate`
 
 After making changes, open a pull request on GitHub. Ensure CI passes and address any review feedback.