feat: upload fork pull request coverage to Codecov

[ernst-dev]

Change

Adds the Codecov fork-coverage wrapper to this repository, so fork pull requests report coverage again. Fork PRs run without secrets, so CODECOV_TOKEN is unavailable and the upload cannot happen from the build job.

Two files, because this repository fans the shared build over a react matrix:

build-lint-test.yml now passes coverage-artifact-name: coverage-report-react${{ matrix.react }}. Artifact names must be unique within a workflow run, and this repository runs two build legs (react: [16, 18]), so the matrix has to be templated into the name — exactly as this file already does for artifact-name: dev-pages-react${{ matrix.react }}. Without this, both legs would upload coverage-report and actions/upload-artifact@v4 would reject the second, failing a build job on fork PRs only.

codecov-fork-upload.yml is the new workflow_run wrapper. It mirrors this repository's existing deploy-fork-preview.yml — same trigger shape, workflow-level permissions, secrets: inherit, and the same strategy.matrix.react: [16, 18] fan-out passing a per-leg artifact-name, so each leg downloads its own coverage artifact.

All privileged logic lives in cloudscape-design/actions; these are only the rollout units. The wrapper never checks out or executes fork code.

Both legs upload, and that is intended

Each leg uploads against the same commit. Codecov's documented behaviour is to merge: "Codecov does not override report data for multiple uploads. We always merge the data." It also holds PR comments until all uploads are in. So the fan-out yields a more complete report than designating a single leg, and it matches how dev-pages already fans out here.

Verified for this repo, not assumed

The caller workflow's name: is exactly Build, lint and test, matching this wrapper's workflow_run.workflows entry. workflow_run matches on workflow name, so a mismatch would silently never fire.

coverage/ is the correct output path: jest.unit.config.js sets collectCoverage when CI === 'true', and neither it nor @cloudscape-design/jest-preset sets coverageDirectory or coverageReporters, so jest's defaults apply and coverage lands in ./coverage.

This wrapper deliberately differs from the four single-leg wrappers (board-components, chart-components, chat-components, code-view): it carries a matrix and passes with:, and it uses this repository's single-quoted workflows: ['Build, lint and test'] style. Local consistency with deploy-fork-preview.yml was preferred over uniformity across repositories.

Rollout order

cloudscape-design/actions#132 must merge first — it adds the coverage-artifact-name input this PR passes. cloudscape-design/actions#131, which added the flow itself, has already landed.

The upstream workflow runs with continue-on-error: true, so a failure there can never block a pull request. The attribution risk and the first-run checks are documented in #131.

Must never be a required status check

This workflow deliberately does not run on merge_group (it only triggers on workflow_run of a pull request build). Adding it as a required status check would deadlock the merge queue.

Context: cloudscape-design/actions#131, cloudscape-design/actions#132, cloudscape-design/build-tools#78.