diff --git a/.codecov.yml b/.codecov.yml
new file mode 100644
index 0000000000..f0a5adef8f
--- /dev/null
+++ b/.codecov.yml
@@ -0,0 +1,31 @@
+codecov:
+  require_ci_to_pass: true
+
+coverage:
+  precision: 2
+  round: down
+  range: "60...80"
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+    patch:
+      default:
+        target: 80%
+        threshold: 5%
+
+ignore:
+  - "**/*_test.go"
+  - "**/testdata/**"
+  - "docs/**"
+  - "hack/**"
+  - "experiments/**"
+  - "images/**"
+  - "**/*.md"
+  - "**/*.sh"
+
+comment:
+  layout: "reach,diff,flags,files,footer"
+  behavior: default
+  require_changes: false
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b9d2358d02..3bee47c4bb 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -36,7 +36,20 @@ jobs:
           echo "1f4e0ef7f6554a6ed33dd7ac144fb2e1bbed98598e7af973042fc5cd43951c9a  /tmp/lychee.tar.gz" | sha256sum -c
           tar xzf /tmp/lychee.tar.gz -C /usr/local/bin --strip-components=1 lychee-x86_64-unknown-linux-gnu/lychee
 
-      - run: make test
+      - run: make lint-all
+
+      - name: Run Go tests with coverage
+        run: go test -race -coverprofile=coverage.out ./...
+        env:
+          GH_TOKEN: ""
+          GITHUB_TOKEN: ""
+
+      - run: make script-test
+
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          files: coverage.out
 
   commit-lint:
     # On pull_request: lint the PR title (which becomes the merge commit