chore: add test coverage report (#25891)

.github/workflows/default.yml

@@ -117,6 +117,13 @@ jobs:
       - name: Test
         run: mkdir dist && touch dist/empty && make test
 
+      - uses: actions/upload-artifact@v5
+        if: ${{ !cancelled() }}
+        with:
+          name: code-coverage-${{ github.sha }}
+          path: coverage.out
+          retention-days: 14
+
   lint:
     name: Lint
     runs-on: depot-ubuntu-24.04-arm
@@ -272,3 +279,25 @@ jobs:
           name: playwright-report
           path: playwright-report/
           retention-days: 14
+
+  code_coverage:
+    name: "Code coverage report"
+    if: github.event_name == 'pull_request' # Do not run when workflow is triggered by push to main branch
+    runs-on: ubuntu-latest
+    needs: [ test ]
+    continue-on-error: true # not critical
+
+    permissions:
+      contents: read
+      actions: read
+      pull-requests: write # write permission needed to comment on PR
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - uses: fgrosse/go-coverage-report@v1.1.1
+        with:
+          coverage-artifact-name: code-coverage-${{ github.sha }}
+          coverage-file-name: coverage.out