ci: allow Codecov coverage uploads

README.md

@@ -31,13 +31,15 @@ read-only and are skipped on later runs.
   request GitHub Apps for owner review. These UI-only settings are recorded in
   `config/manual-settings.json`.
 - GitHub Actions defaults to read-only, cannot approve pull requests, and may
-  use only Atrinik, GitHub, and explicitly allowed Docker actions.
+  use only Atrinik, GitHub, Codecov coverage, and explicitly allowed Docker
+  actions.
 - Historical repositories listed in `config/repositories.json` are archived.
 
 The GitHub REST API does not expose every organization control. The desired
 values are recorded in `config/manual-settings.json` and must be confirmed in
-the organization UI under **Member privileges** and **Authentication
-security**.
+the organization UI under **Member privileges**, **Authentication security**,
+and **GitHub Apps**. Codecov must be installed for the listed repositories so
+their OIDC-authenticated coverage uploads and badges remain available.
 
 ## Usage
 

config/actions-selected.json

@@ -3,6 +3,7 @@
   "verified_allowed": false,
   "patterns_allowed": [
     "atrinik/*",
+    "codecov/codecov-action@*",
     "docker/login-action@*",
     "docker/setup-buildx-action@*",
     "docker/build-push-action@*"

config/manual-settings.json

@@ -4,7 +4,13 @@
   "members_can_create_teams": false,
   "repository_admins_can_install_github_apps": false,
   "members_can_request_github_apps": true,
+  "codecov_github_app_repositories": [
+    "atrinik",
+    "client",
+    "libatrinik",
+    "server"
+  ],
   "require_two_factor_authentication": true,
   "require_secure_two_factor_methods": true,
-  "reason": "The public GitHub API does not expose supported update parameters for every setting in this file. Confirm them in the organization UI."
+  "reason": "The public GitHub API does not expose supported update parameters for every setting in this file. Confirm them and the Codecov GitHub App repository access in the organization UI."
 }