ci(codecov): add codecov.yml config and Socket badge

[amondnet]

Adds Codecov configuration and observability badges.

Changes

• codecov.yml (new, validated via Codecov's validator → Valid!):
  • project status: auto target with a 1% threshold (avoids flaky failures on tiny dips)
  • patch status: 80% target for new/changed lines
  • ignore: test, dist, *.test.ts, *.d.ts (source-only coverage)
• README — Socket badge: added the Socket.dev package-health badge (Socket Security checks already run in CI)
• README — CI badge fix: the CI badge image pointed at the wrong repo (pleaseai/gh-please); corrected to pleaseai/cli-toolkit

Notes

• Coverage upload already works: bunfig.toml emits coverage/lcov.info and ci.yml uploads it via codecov/codecov-action@v5. This PR only adds the missing config file + badge.
• The codecov badge was already present and is unchanged.
• Socket badge URL uses Socket's standard format; couldn't render-verify from the sandbox (Socket blocks non-browser requests with 403). Please confirm it renders on GitHub.

---

Summary by cubic

Add Codecov config to stabilize coverage checks: 80% patch target, 1% project threshold, ignoring test, dist, **/*.test.ts, and **/*.d.ts; also fix YAML scalar style in codecov.yml to satisfy repo lint.

Update README to add the Socket.dev package-health badge and fix the CI badge to point to pleaseai/cli-toolkit.

^{Written for commit 739d78e. Summary will update on new commits.}

Summary by CodeRabbit

• Documentation
  • Updated the README status badges, including CI, code coverage, and security scanning badges.
• Chores
  • Added coverage configuration with project and patch thresholds, plus reporting settings and excluded file patterns.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a new Codecov configuration with project and patch coverage rules, comment settings, and ignore globs. Updates the README badge block to point CI at the new workflow and add Codecov and Socket badges.

Changes

Coverage reporting and badges

Layer / File(s)	Summary
Coverage reporting setup codecov.yml, README.md	Adds Codecov coverage thresholds and PR comment settings, excludes test and type-only files from coverage, and updates the README badges to use the new CI workflow plus Codecov and Socket badges.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

I’m a rabbit with a happy hop,
New badges gleam from top to top.
Coverage carrots, bright and neat,
Make the README extra sweet.
Thump! 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main changes: adding Codecov config and a Socket badge update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/codecov-config-badges

---

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the CI badge URL and adds a Socket badge to the README, and introduces a new Codecov configuration file. The review feedback correctly identifies that the ignore setting in codecov.yml is placed at the root level instead of under the codecov key, which would prevent Codecov from properly ignoring the specified test and build directories.

[greptile-apps]

Greptile Summary

This PR adds a codecov.yml configuration file and tidies up the README badges. No source code is changed.

• codecov.yml: configures an auto project target with a 1% tolerance threshold (prevents flaky failures on minor coverage dips) and an 80% patch target for new/changed lines; test, dist, and declaration files are excluded from coverage metrics.
• README.md: fixes the CI badge image URL, which was incorrectly pointing to pleaseai/gh-please instead of pleaseai/cli-toolkit, and adds a Socket.dev package-health badge using Socket's standard badge URL format.

Confidence Score: 5/5

Safe to merge — all changes are documentation and CI configuration with no impact on runtime behaviour.

Both files are purely observability and documentation artefacts. The badge fix corrects a pre-existing wrong repo reference, the Socket badge uses Socket's documented URL format, and the Codecov YAML was validated externally and follows standard configuration patterns. There is nothing here that can break the build or affect any shipped code.

No files require special attention.

Important Files Changed

Filename	Overview
README.md	CI badge image URL corrected from pleaseai/gh-please to pleaseai/cli-toolkit; Socket.dev package-health badge added in standard format.
codecov.yml	New Codecov config: auto project target with 1% threshold, 80% patch target, comment layout, and ignore patterns for test/dist/declaration files.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Push / PR] --> B[CI Workflow]
    B --> C[Run Tests + Coverage]
    C --> D[Upload lcov.info\ncodecov/codecov-action@v5]
    D --> E{Codecov Checks}
    E --> F[Project Status\ntarget: auto\nthreshold: 1%]
    E --> G[Patch Status\ntarget: 80%\nthreshold: 0%]
    F --> H{Pass?}
    G --> I{Pass?}
    H -- Yes --> J[✅ Project Check Passes]
    H -- No --> K[❌ Project Check Fails]
    I -- Yes --> L[✅ Patch Check Passes]
    I -- No --> M[❌ Patch Check Fails]
    D --> N[Codecov Comment\nlayout: reach, diff, flags, files]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Push / PR] --> B[CI Workflow]
    B --> C[Run Tests + Coverage]
    C --> D[Upload lcov.info\ncodecov/codecov-action@v5]
    D --> E{Codecov Checks}
    E --> F[Project Status\ntarget: auto\nthreshold: 1%]
    E --> G[Patch Status\ntarget: 80%\nthreshold: 0%]
    F --> H{Pass?}
    G --> I{Pass?}
    H -- Yes --> J[✅ Project Check Passes]
    H -- No --> K[❌ Project Check Fails]
    I -- Yes --> L[✅ Patch Check Passes]
    I -- No --> M[❌ Patch Check Fails]
    D --> N[Codecov Comment\nlayout: reach, diff, flags, files]

Loading

_{Reviews (2): Last reviewed commit: "chore: apply AI code review suggestions" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@codecov.yml`:
- Around line 16-26: The YAML in codecov.yml is tripping the repo’s scalar-style
lint rules, so normalize the scalar formatting in the comment, layout, behavior,
require_changes, and ignore entries to match the project’s YAML
quoting/plain-scalar conventions. Update the codecov configuration block so the
scalar style is consistent throughout and passes yaml/quotes and
yaml/plain-scalar checks.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f8a3411-36c7-41fc-92d1-e7645b13ada2

📥 Commits

Reviewing files that changed from the base of the PR and between caa4d68 and eb8164d.

📒 Files selected for processing (2)

• README.md
• codecov.yml

[cubic-dev-ai]

1 issue found across 2 files

Architecture diagram

sequenceDiagram
    participant Dev as Developer
    participant CI as GitHub Actions
    participant CovAction as Codecov Action
    participant CovAPI as Codecov API
    participant Readme as GitHub README (static)

    Dev->>CI: push/merge to branch
    CI->>CI: run tests & collect coverage (bun --coverage)
    CI->>CovAction: upload coverage/lcov.info
    CovAction->>CovAPI: POST /upload (includes repo’s codecov.yml)
    CovAPI->>CovAPI: evaluate thresholds (project: 1%, patch: 80%)
    CovAPI-->>CI: coverage status (pass/fail)
    Note over CovAPI,Readme: existing Codecov badge (unchanged)
    Note over Readme: added Socket.dev badge (static URL)

Loading

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!