ci: upload coverage to codecov

.github/workflows/README.md

@@ -10,6 +10,7 @@ Il workflow `ci.yml` esegue i seguenti check automatici:
 
 ### 2. Test Coverage
 - Frontend: vitest con coverage reporting
+- Upload automatico su Codecov dai report LCOV frontend + Rust
 - Threshold configurabile in `vitest.config.ts`
 
 ### 3. Code Health (CodeScene)
@@ -40,6 +41,11 @@ CODESCENE_PROJECT_ID=<your-project-id>
 Il PAT di CodeScene è lo stesso che usi localmente (~/.codescene/token).
 Il project ID lo trovi nella dashboard CodeScene.
 
+### Codecov Setup
+- Installa/attiva il repo in Codecov una volta sola tramite GitHub App / import del repository.
+- Nessun `CODECOV_TOKEN` richiesto in GitHub Actions: `ci.yml` usa OIDC (`id-token: write` + `use_oidc: true`).
+- Il workflow carica `coverage/lcov.info` (Vitest) e `coverage/rust.lcov` (cargo-llvm-cov).
+
 ### Telemetry Secrets For Release Builds
 Aggiungi anche questi secrets per i workflow `release.yml` e `release-stable.yml`:
 
@@ -97,8 +103,11 @@ codescene delta-analysis --base-revision origin/main
 
 ## Workflow Triggers
 
-- **Push**: su `main` e branch `experiment/*`
+- **Push**: su `main`
 - **Pull Request**: verso `main`
+- **Manuale**: `workflow_dispatch`
+
+Nota: l'upload a Codecov gira su push a `main` e sulle PR dello stesso repository. Le PR da fork saltano l'upload per evitare problemi di permessi OIDC.
 
 ## Status Checks
 

.github/workflows/ci.yml

@@ -3,6 +3,13 @@ name: CI
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
 
 env:
   # Bump this when Tauri/Rust target artifacts capture stale absolute paths.
@@ -78,10 +85,23 @@ jobs:
           cargo llvm-cov \
             --manifest-path src-tauri/Cargo.toml \
             --ignore-filename-regex 'lib\.rs|main\.rs|menu\.rs' \
+            --lcov \
+            --output-path coverage/rust.lcov \
             --fail-under-lines 85
         # cargo-llvm-cov exits non-zero if line coverage drops below 85%
         # lib.rs/main.rs/menu.rs are Tauri boilerplate -- not meaningfully unit-testable.
 
+      - name: Upload coverage to Codecov
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          fail_ci_if_error: true
+          disable_search: true
+          files: ./coverage/lcov.info,./coverage/rust.lcov
+          verbose: true
+        # OIDC avoids long-lived CODECOV_TOKEN secrets.
+
       # ── 3. Code Health (CodeScene — Hotspot + Average Code Health gates) ──
       # Enforces minimum floors on BOTH hotspot and average code health.
       # Thresholds come from .codescene-thresholds so CI and local hooks match.