ci: replace CodeCov with GitHub native coverage API for Go

[code-coverage-agent]

Sets up Go code coverage reporting using GitHub's native coverage API, replacing the previous CodeCov integration. Also fixes an arbitrary file write vulnerability in actions/download-artifact.

Changes

• go.mod / go.sum: Added github.com/boumenot/gocover-cobertura v1.5.0 as a go tool dependency for converting Go's native coverage.out profile to Cobertura XML
• .gitignore: Added coverage.out and coverage.xml to exclude coverage artifacts from commits
• .github/workflows/coverage.yml: Rewrote coverage workflow:
  • Runs go tool gotestsum with -coverprofile=coverage.out -covermode=count ./...
  • Converts to Cobertura XML via go tool gocover-cobertura
  • Uploads report via actions/upload-code-coverage@v1 with language: Go
  • Splits into two jobs (coverage / upload-coverage-go) so the privileged code-quality: write token is isolated from the code-executing job
  • Fork PR guards on both the artifact upload step and the upload job
  • Triggers on push to master (baseline), pull_request, and merge_group
  • Security fix: actions/download-artifact bumped from @v4 → @v8 to fix arbitrary file write CVE (affected >= 4.0.0, < 4.1.3); actions/upload-artifact bumped to @v7 (current latest major)

Community Note

• Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Release note for CHANGELOG:

NONE

[github-code-quality]

Code Coverage Overview

Languages: Go

Go / code-coverage-agent

The overall coverage in commit 5f2fd27 in the code-coverage-agent/... branch is 50%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	code-coverage-agent/... 5f2fd27	+/-
internal/namesp...instance_cli.go	—	91%	—
internal/namesp...aremetal_cli.go	—	91%	—
internal/namesp...ontainer_cli.go	—	91%	—
internal/namesp...lb/v1/lb_cli.go	—	90%	—
internal/namesp...s/v1/k8s_cli.go	—	90%	—
internal/namesp...b/v1/rdb_cli.go	—	87%	—
internal/namesp...function_cli.go	—	86%	—
internal/namesp...c/v2/vpc_cli.go	—	86%	—
internal/namesp...pha1/iam_cli.go	—	84%	—
internal/namesp...bhosting_cli.go	—	84%	—

---

_{Updated August 10, 2026 12:16 UTC}