feat(ci): Add 80% coverage threshold enforcement

- Add coverage-check target to Makefile with 80% threshold
- Add coverage threshold check step to CI workflow for Go 1.25
- Create codecov.yml with project/patch coverage targets (80%)
- Add input validation for missing coverage file and empty results
- Keep Codecov as informational only (inline check is the hard gate)

Task: #3835

Author: mattmattox

.github/workflows/ci.yml

@@ -73,9 +73,35 @@ jobs:
             go tool cover -func=coverage-integration.out | grep total | awk '{print "Integration test coverage: " $3}'
           fi
 
+      - name: Check coverage threshold
+        if: matrix.go-version == '1.25'
+        run: |
+          if [ ! -f coverage.out ]; then
+            echo "::error::Coverage file not found"
+            exit 1
+          fi
+
+          COVERAGE=$(go tool cover -func=coverage.out | grep total | awk '{print $3}' | sed 's/%//')
+
+          if [ -z "$COVERAGE" ]; then
+            echo "::error::Failed to extract coverage percentage"
+            exit 1
+          fi
+
+          THRESHOLD=80
+          echo "Current coverage: ${COVERAGE}%"
+          echo "Minimum threshold: ${THRESHOLD}%"
+
+          if (( $(echo "$COVERAGE < $THRESHOLD" | bc -l) )); then
+            echo "::error::Coverage ${COVERAGE}% is below minimum threshold of ${THRESHOLD}%"
+            exit 1
+          fi
+          echo "Coverage check passed!"
+
       - name: Upload coverage to Codecov
         if: matrix.go-version == '1.25'
         uses: codecov/codecov-action@v4
+        continue-on-error: true  # Codecov is informational; inline check above is the hard gate
         with:
           files: ./coverage.out,./coverage-integration.out
           flags: unittests

Makefile

@@ -23,7 +23,8 @@
 	check-prerequisites check-docker check-kubectl \
 	build test test-integration test-e2e test-all \
 	lint fmt clean install-deps \
-	docker-build docker-push
+	docker-build docker-push \
+	coverage-check
 
 # ================================================================================================
 # Project Configuration
@@ -232,6 +233,20 @@ test-all:
 	@go tool cover -func=coverage/coverage.out | grep total | awk '{print "Total coverage: " $$3}'
 	@$(call print_success,"All tests passed - coverage report: coverage/coverage.html")
 
+# Check coverage meets minimum threshold (80%)
+COVERAGE_THRESHOLD := 80
+coverage-check:
+	@$(call print_status,"Checking coverage threshold (minimum $(COVERAGE_THRESHOLD)%)...")
+	@mkdir -p coverage
+	@go test ./... -covermode=atomic -coverprofile=coverage/coverage.out -short > /dev/null 2>&1
+	@COVERAGE=$$(go tool cover -func=coverage/coverage.out | grep total | awk '{print $$3}' | sed 's/%//'); \
+	echo "Current coverage: $${COVERAGE}%"; \
+	if [ $$(echo "$${COVERAGE} < $(COVERAGE_THRESHOLD)" | bc -l) -eq 1 ]; then \
+		$(call print_error,"Coverage $${COVERAGE}% is below minimum threshold of $(COVERAGE_THRESHOLD)%"); \
+		exit 1; \
+	fi
+	@$(call print_success,"Coverage check passed (>= $(COVERAGE_THRESHOLD)%)")
+
 # Lint code with golangci-lint
 lint:
 	@$(call print_status,"Running golangci-lint...")
@@ -546,6 +561,7 @@ help:
 	@echo "  make test-integration      Run integration tests"
 	@echo "  make test-e2e              Run end-to-end tests"
 	@echo "  make test-all              Run all tests with coverage report"
+	@echo "  make coverage-check        Verify coverage >= 80% threshold"
 	@echo "  make lint                  Run golangci-lint"
 	@echo "  make fmt                   Format code with gofmt and goimports"
 	@echo ""

codecov.yml

@@ -0,0 +1,48 @@
+# Codecov Configuration
+# https://docs.codecov.com/docs/codecov-yaml
+
+coverage:
+  # Global coverage thresholds
+  precision: 2
+  round: down
+  range: "70...100"
+
+  status:
+    # Project-level coverage (overall repository)
+    project:
+      default:
+        target: 80%
+        threshold: 2%
+        if_ci_failed: error
+
+    # Patch-level coverage (only changed lines in PR)
+    patch:
+      default:
+        target: 80%
+        threshold: 5%
+        if_ci_failed: error
+
+# Comment configuration for PRs
+comment:
+  layout: "reach,diff,flags,tree,betaprofiling"
+  behavior: default
+  require_changes: true
+  require_base: false
+  require_head: true
+
+# Ignore certain paths from coverage
+ignore:
+  - "**/*_test.go"
+  - "**/test/**"
+  - "**/testdata/**"
+  - "docs/**"
+  - "deployment/**"
+  - "helm/**"
+
+# Flag management
+flags:
+  unittests:
+    paths:
+      - pkg/
+      - cmd/
+    carryforward: true