ci: enable coverage in github actions

.github/workflows/ci.yml

@@ -1,5 +1,6 @@
 name: CI
 on:
+  push:
   pull_request:
 jobs:
   lint:
@@ -27,7 +28,10 @@ jobs:
     - name: build (LLVM ${{ matrix.llvm_version }})
       # Run the build manually in `nix develop` to keep non-outputs around
       run: |
-        nix develop .#oid-llvm${{ matrix.llvm_version }} --command cmake -B build -G Ninja -DWITH_FLAKY_TESTS=Off -DFORCE_BOOST_STATIC=Off
+        nix develop .#oid-llvm${{ matrix.llvm_version }} --command cmake -B build -G Ninja \
+          -DWITH_FLAKY_TESTS=Off \
+          -DFORCE_BOOST_STATIC=Off \
+          -DCODE_COVERAGE=On
         nix develop .#oid-llvm${{ matrix.llvm_version }} --command ninja -C build
     - name: test (LLVM ${{ matrix.llvm_version }})
       env:
@@ -46,9 +50,37 @@ jobs:
           --repeat until-pass:3 \
           --exclude-from-file ../../.github/workflows/tests_failing_under_nix.txt \
           --output-junit results.xml
+
+    - name: prepare coverage
+      run: |
+        nix run nixpkgs#lcov -- --capture --directory . --filter branch --no-external --ignore-errors mismatch --ignore-errors source --rc lcov_branch_coverage=1 --output-file coverage.info
+        # Empirically, extract-then-remove is faster than remove-then-extract
+        nix run nixpkgs#lcov -- --extract coverage.info '/tmp/object-introspection/*' --rc lcov_branch_coverage=1 --output-file coverage.info
+        nix run nixpkgs#lcov -- --remove coverage.info '/tmp/object-introspection/build/*' '/tmp/object-introspection/extern/*'  --rc lcov_branch_coverage=1 --output-file coverage.info
+        nix run nixpkgs#lcov -- --list --rc lcov_branch_coverage=1 coverage.info
+
+    - name: upload coverage
+      continue-on-error: true
+      uses: coverallsapp/github-action@v2
+      with:
+        flag-name: run-${{ join(matrix.*, '-') }}
+        parallel: true
+
     - name: upload results
       uses: actions/upload-artifact@v4
       if: success() || failure()
       with:
         name: test-results-${{ matrix.llvm_version }}
         path: build/test/results.xml
+
+  finalise-coverage:
+    needs: build-test
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+    - name: finalise coverage
+      uses: coverallsapp/github-action@v2
+      with:
+        parallel-finished: true
+        carryforward: "run-15,run-16"
+