diff --git a/.github/workflows/ci-sharktuner.yml b/.github/workflows/ci-sharktuner.yml
index 1e6620302f0..e67a2f0f581 100644
--- a/.github/workflows/ci-sharktuner.yml
+++ b/.github/workflows/ci-sharktuner.yml
@@ -28,19 +28,30 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-24.04
+    name: "Unit Tests (py${{ matrix.tuner-python-version }}, ${{ matrix.runs-on }})"
+
+    strategy:
+      matrix:
+        tuner-python-version: ["3.10.12"]
+        mypy-python-version: ["3.11"]
+        runs-on: [ubuntu-24.04]
+    runs-on: ${{matrix.runs-on}}
+    defaults:
+      run:
+        shell: bash
     env:
       PIP_CACHE_DIR: "${{ github.workspace }}/.pip-cache"
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
 
       - name: Set up Python
+        id: setup_python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.10.12'
+          python-version: ${{matrix.tuner-python-version}}
 
-      - name: Cache pip
+      - name: Cache pip packages
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         id: cache-pip
         with:
@@ -61,6 +72,9 @@ jobs:
             -e sharktuner/
           pip freeze
 
+      - name: Run mypy type checker
+        run: mypy sharktuner --python-version ${{ matrix.mypy-python-version }}
+
       - name: Run sharktuner tests with coverage
         run: |
           pytest sharktuner/ \
@@ -72,17 +86,39 @@ jobs:
           COVERAGE_FILE: .coverage.sharktuner
 
       - name: Upload coverage data
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-data-sharktuner
           path: .coverage.sharktuner
           include-hidden-files: true
 
-      - name: Upload sharktuner coverage to Codecov
-        if: ${{ github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }}
-        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-24.04
+    needs: test
+    permissions:
+      pull-requests: write
+      contents: write
+      actions: read
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        id: download
         with:
-          files: sharktuner-cov.xml
+          name: coverage-data-sharktuner
 
-      - name: Run mypy type checker
-        run: mypy sharktuner --python-version 3.11
+      - name: Coverage comment
+        id: coverage_comment
+        uses: py-cov-action/python-coverage-comment-action@91910686861e4e1d8282a267a896eb39d46240fb # v3.35
+        with:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          MERGE_COVERAGE_FILES: true
+          MINIMUM_GREEN: 90
+          MINIMUM_ORANGE: 70
+
+      - name: Store Pull Request comment to be posted
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: steps.coverage_comment.outputs.COMMENT_FILE_WRITTEN == 'true'
+        with:
+          name: python-coverage-comment-action
+          path: python-coverage-comment-action.txt