chore[ci]: separate codecov upload into separate job (#4455)

this commit separates `coverage combine` (the local tool) and codecov
upload (upload to 3rd party app) into separate steps. it also uploads
the coverage report artifacts. this makes the actions more transparent
since we can download the coverage database to inspect it if there is
an issue, and allows us to set the `coverage report` as a required CI
check, which does not depend on a 3rd party service. (if it depended on
a 3rd party service, we might then be unable to merge PRs if there is
an issue on the 3rd party service's side).

.github/workflows/test.yml

@@ -234,9 +234,9 @@ jobs:
         if: ${{ needs.fuzzing.result != 'success' }}
         run: exit 1
 
-  consolidate-coverage:
-    # Consolidate code coverage using `coverage combine` and upload
-    # to the codecov app
+  coverage-report:
+    # Consolidate code coverage using `coverage combine` and
+    # call coverage report with fail-under=90
     runs-on: ubuntu-latest
     needs: [tests, fuzzing]
 
@@ -261,8 +261,43 @@ jobs:
     - name: Combine coverage
       run: |
         coverage combine coverage-files/**/.coverage
+
+    - name: Coverage report
+      # coverage report and fail if coverage is too low
+      run: |
+        coverage report --fail-under=90
+
+    - name: Generate coverage.xml
+      run: |
         coverage xml
 
+    - name: Upload coverage sqlite artifact
+      # upload coverage sqlite db for debugging
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-sqlite
+        include-hidden-files: true
+        path: .coverage
+        if-no-files-found: error
+
+    - name: Upload coverage.xml
+      uses: actions/upload-artifact@v4
+      with:
+        name: coverage-xml
+        path: coverage.xml
+        if-no-files-found: error
+
+  upload-coverage:
+    # upload coverage to the codecov app
+    runs-on: ubuntu-latest
+    needs: [coverage-report]
+
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/download-artifact@v4
+      with:
+        name: coverage-xml
+
     - name: Upload Coverage
       uses: codecov/codecov-action@v5
       with: