diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index 4fcd1b906..690a40010 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -117,6 +117,13 @@ jobs:
       - name: Test
         run: mkdir dist && touch dist/empty && make test
 
+      - uses: actions/upload-artifact@v5
+        if: ${{ !cancelled() }}
+        with:
+          name: code-coverage-${{ github.sha }}
+          path: coverage.out
+          retention-days: 14
+
   lint:
     name: Lint
     runs-on: depot-ubuntu-24.04-arm
@@ -272,3 +279,25 @@ jobs:
           name: playwright-report
           path: playwright-report/
           retention-days: 14
+
+  code_coverage:
+    name: "Code coverage report"
+    if: github.event_name == 'pull_request' # Do not run when workflow is triggered by push to main branch
+    runs-on: ubuntu-latest
+    needs: [ test ]
+    continue-on-error: true # not critical
+
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write # write permission needed to comment on PR
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: fgrosse/go-coverage-report@v1.1.1
+        with:
+          coverage-artifact-name: code-coverage-${{ github.sha }}
+          coverage-file-name: coverage.out
diff --git a/Makefile b/Makefile
index 98aa3b70c..629606629 100644
--- a/Makefile
+++ b/Makefile
@@ -80,7 +80,7 @@ test-ui::
 
 test::
 	@echo "Running testsuite"
-	CGO_ENABLED=0 go test $(BUILD_TAGS) ./...
+	CGO_ENABLED=0 go test $(BUILD_TAGS) -coverprofile=coverage.out -covermode=atomic ./...
 
 porcelain::
 	gofmt -w -l $$(find . -name '*.go')