feat: extend coverage-gate with install command and artifact upload

.github/workflows/coverage-gate.yml

@@ -18,6 +18,10 @@ on:
         description: 'Command (bash) that produces a coverage report. Empty to skip.'
         type: string
         default: ''
+      install_command:
+        description: 'Command (bash) that installs the coverage tool, e.g. `cargo install cargo-llvm-cov`. Empty to skip; runs before the coverage command.'
+        type: string
+        default: ''
       files:
         description: 'Coverage file(s) to upload (comma-separated). Empty lets Codecov search.'
         type: string
@@ -41,6 +45,18 @@ on:
       timeout_minutes:
         type: number
         default: 20
+      upload_artifact:
+        description: 'When true, uploads the coverage report file as a workflow artifact.'
+        type: boolean
+        default: false
+      artifact_name:
+        description: 'Name of the workflow artifact to upload.'
+        type: string
+        default: 'coverage-report'
+      artifact_path:
+        description: 'Path (file or directory) of the report to upload. Required when upload_artifact is true.'
+        type: string
+        default: ''
     secrets:
       codecov_token:
         required: false
@@ -67,11 +83,17 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Run install command
+        if: ${{ inputs.install_command != '' }}
+        env:
+          INSTALL_COMMAND: ${{ inputs.install_command }}
+        run: bash -euo pipefail -c "$INSTALL_COMMAND"
+
       - name: Produce coverage
         if: ${{ inputs.coverage_command != '' }}
         env:
           COVERAGE_COMMAND: ${{ inputs.coverage_command }}
-        run: bash -c "$COVERAGE_COMMAND"
+        run: bash -euo pipefail -c "$COVERAGE_COMMAND"
 
       - name: Upload to Codecov
         if: ${{ inputs.use_codecov }}
@@ -88,3 +110,12 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           file: ${{ inputs.coveralls_file }}
+
+      - name: Upload coverage report artifact
+        if: ${{ inputs.upload_artifact }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: ${{ inputs.artifact_name }}
+          path: ${{ inputs.artifact_path }}
+          if-no-files-found: error
+          retention-days: 14

CHANGELOG.md

@@ -22,6 +22,15 @@
 
 ### Added
 
+- **`coverage-gate.yml` gained an install command and artifact upload.** Four
+  new inputs: `install_command` (string, default `''` — runs before the coverage
+  command to install the coverage tool, e.g. `cargo install cargo-llvm-cov`;
+  skipped when empty), `upload_artifact` (boolean, default false),
+  `artifact_name` (string, default `coverage-report`), and `artifact_path`
+  (string, default `''` — required when `upload_artifact` is true). When
+  `upload_artifact` is true, the report is uploaded as a workflow artifact via
+  `actions/upload-artifact`. Off by default, so existing callers are unaffected.
+
 - **`actionlint.yml` grew optional shellcheck support.** Three new inputs —
   `enable_shellcheck` (boolean, default false), `shellcheck_version` (default
   `0.11.0`), and `shellcheck_sha256` (SHA256 of

catalog/capabilities.yml

@@ -1247,8 +1247,10 @@ capabilities:
     risks:
       - "Coverage thresholds are enforced by the caller's codecov.yml, not this workflow"
       - "Private-repo runner minutes are metered beyond the included free allotment"
+      - "install_command runs arbitrary caller-supplied bash before the coverage command; keep it trusted and least-privilege"
+      - "upload_artifact (default off) uploads artifact_path via actions/upload-artifact using the job token; it needs artifact_path set and fails closed if no files match"
     deprecations: null
-    last_verified: "2026-07-08"
+    last_verified: "2026-08-04"
     sources:
       - "https://docs.codecov.com/docs"
       - "https://github.com/codecov/codecov-action"

catalog/tools.yml

@@ -163,7 +163,8 @@ tools:
     pin: "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
     used_by:
       - .github/workflows/release-supply-chain.yml
-    last_verified: "2026-07-04"
+      - .github/workflows/coverage-gate.yml
+    last_verified: "2026-08-04"
 
   - id: flutter-action
     name: subosito/flutter-action