diff --git a/.github/actions/codecov-merge-upload/action.yml b/.github/actions/codecov-merge-upload/action.yml
new file mode 100644
index 0000000000..f5f989f0a6
--- /dev/null
+++ b/.github/actions/codecov-merge-upload/action.yml
@@ -0,0 +1,58 @@
+name: 'Codecov Download and Upload'
+description: 'Download coverage artifacts from previous PR runs and upload to Codecov'
+
+inputs:
+  coverage-path:
+    description: 'Path to coverage files'
+    required: true
+  workflow-paths:
+    description: 'Comma-separated list of workflow paths for artifact lookup (e.g., ".github/workflows/router-ci.yaml,.github/workflows/cli-ci.yaml")'
+    required: true
+  override-commit:
+    description: 'Commit SHA to override in Codecov'
+    required: true
+  merge-commit-sha:
+    description: 'Merge commit SHA to look up the PR and find head SHA'
+    required: false
+    default: ''
+  codecov-token:
+    description: 'Codecov token for uploading'
+    required: true
+  github-token:
+    description: 'GitHub token for artifact operations'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Find latest successful PR runs for this commit
+      id: find-artifacts
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        REPO: ${{ github.repository }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        MERGE_COMMIT_SHA: ${{ inputs.merge-commit-sha }}
+        CURRENT_RUN_ID: ${{ github.run_id }}
+        ARTIFACT_NAME_PATTERN: codecov
+        WORKFLOW_PATHS: ${{ inputs.workflow-paths }}
+      run: ./.github/scripts/find-codecov-artifact.sh
+
+    - name: Download coverage artifacts
+      if: steps.find-artifacts.outputs.has_artifacts == 'true'
+      shell: bash
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+        REPO: ${{ github.repository }}
+        ARTIFACTS_JSON: ${{ steps.find-artifacts.outputs.artifacts_json }}
+        COVERAGE_PATH: ${{ inputs.coverage-path }}
+      run: ./.github/scripts/download-codecov-artifacts.sh
+
+    - name: Upload results to Codecov
+      if: steps.find-artifacts.outputs.has_artifacts == 'true'
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ inputs.codecov-token }}
+        override_commit: ${{ inputs.override-commit }}
+        override_branch: main
+        directory: ${{ inputs.coverage-path }}
diff --git a/.github/actions/codecov-upload-pr/action.yml b/.github/actions/codecov-upload-pr/action.yml
new file mode 100644
index 0000000000..6ddf87f4f4
--- /dev/null
+++ b/.github/actions/codecov-upload-pr/action.yml
@@ -0,0 +1,34 @@
+name: 'Codecov Upload PR'
+description: 'Upload coverage artifacts during PR and send to Codecov'
+
+inputs:
+  artifact-name:
+    description: 'Name of the coverage artifact'
+    required: false
+    default: 'pr-build'
+  coverage-path:
+    description: 'Path to coverage files'
+    required: true
+  retention-days:
+    description: 'Days to retain the artifact'
+    required: false
+    default: '7'
+  codecov-token:
+    description: 'Codecov token for uploading'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Upload artifact for PR
+      uses: actions/upload-artifact@v4
+      with:
+        overwrite: true
+        name: codecov-pr-build-${{ inputs.artifact-name }}
+        path: ${{ inputs.coverage-path }}
+        retention-days: ${{ inputs.retention-days }}
+
+    - name: Upload results to Codecov
+      uses: codecov/codecov-action@v5
+      with:
+        token: ${{ inputs.codecov-token }}
\ No newline at end of file
diff --git a/.github/scripts/download-codecov-artifacts.sh b/.github/scripts/download-codecov-artifacts.sh
new file mode 100755
index 0000000000..6847c68ca4
--- /dev/null
+++ b/.github/scripts/download-codecov-artifacts.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+# This script downloads coverage artifacts from GitHub Actions runs.
+#
+# Required environment variables:
+#   GITHUB_TOKEN: Required for GitHub CLI authentication
+#   REPO: GitHub repository (e.g., owner/repo)
+#   ARTIFACTS_JSON: JSON array of artifacts to download (from find-codecov-artifact.sh output)
+#   COVERAGE_PATH: Directory where artifacts should be downloaded
+#
+
+set -e
+
+GITHUB_TOKEN="${GITHUB_TOKEN:?GITHUB_TOKEN environment variable is required}"
+REPO="${REPO:?REPO environment variable is required}"
+ARTIFACTS_JSON="${ARTIFACTS_JSON:?ARTIFACTS_JSON environment variable is required}"
+COVERAGE_PATH="${COVERAGE_PATH:?COVERAGE_PATH environment variable is required}"
+
+echo "Downloading artifacts..."
+
+# Validate JSON before processing
+if ! echo "$ARTIFACTS_JSON" | jq empty 2>/dev/null; then
+  echo "ERROR: Invalid JSON received from artifact discovery step" >&2
+  echo "JSON content (truncated to 500 chars):" >&2
+  echo "$ARTIFACTS_JSON" | head -c 500 >&2
+  echo "" >&2
+  exit 1
+fi
+
+echo "$ARTIFACTS_JSON" | jq -c '.[]' | while read -r artifact; do
+  run_id=$(echo "$artifact" | jq -r '.run_id')
+  artifact_id=$(echo "$artifact" | jq -r '.artifact_id')
+  artifact_name=$(echo "$artifact" | jq -r '.artifact_name')
+
+  echo "Downloading artifact: $artifact_name (ID: $artifact_id) from run: $run_id"
+
+  # Download artifact using GitHub CLI
+  gh run download "$run_id" \
+    --repo "$REPO" \
+    --name "$artifact_name" \
+    --dir "$COVERAGE_PATH/$artifact_name"
+
+  if [ $? -eq 0 ]; then
+    echo "✓ Successfully downloaded $artifact_name"
+  else
+    echo "✗ Failed to download $artifact_name" >&2
+    exit 1
+  fi
+done
+
+echo "All artifacts downloaded successfully"
+
diff --git a/.github/scripts/find-codecov-artifact.sh b/.github/scripts/find-codecov-artifact.sh
new file mode 100755
index 0000000000..9d14c82a0b
--- /dev/null
+++ b/.github/scripts/find-codecov-artifact.sh
@@ -0,0 +1,292 @@
+#!/bin/bash
+
+# This script finds the latest successful workflow run artifacts for a PR commit.
+#
+# Required environment variables:
+#   REPO: GitHub repository (e.g., owner/repo)
+#   CURRENT_RUN_ID: The current workflow run ID
+#   ARTIFACT_NAME_PATTERN: Pattern to match artifact names (e.g., "codecov-pr-build")
+#   WORKFLOW_PATHS: Comma-separated list of workflow file paths to filter by (e.g., ".github/workflows/router-ci.yaml,.github/workflows/cli-ci.yaml")
+#   GITHUB_TOKEN: Required for API authentication
+#
+# Optional environment variables:
+#   HEAD_SHA: The PR head commit SHA (if running in PR context)
+#   MERGE_COMMIT_SHA: The merge commit SHA (if running after merge to main)
+#
+# Outputs (to $GITHUB_OUTPUT):
+#   artifacts_json: JSON array of objects with run_id, artifact_id, and artifact_name
+#
+
+set -e
+set -o pipefail
+
+REPO="${REPO:?REPO environment variable is required}"
+CURRENT_RUN_ID="${CURRENT_RUN_ID:?CURRENT_RUN_ID environment variable is required}"
+ARTIFACT_NAME_PATTERN="${ARTIFACT_NAME_PATTERN:?ARTIFACT_NAME_PATTERN environment variable is required}"
+WORKFLOW_PATHS="${WORKFLOW_PATHS:?WORKFLOW_PATHS environment variable is required}"
+
+# If MERGE_COMMIT_SHA is provided, look up the PR to get HEAD_SHA
+if [ -n "$MERGE_COMMIT_SHA" ]; then
+  echo "Merge commit SHA provided: $MERGE_COMMIT_SHA"
+  echo "Looking up PR for merge commit..."
+
+  # Search for PRs that were merged with this commit (with retry logic for timing issues as github might
+  # take some time to index the new PR-commit association)
+  max_retries=5
+  retry_count=0
+  pr_json=""
+  backoff_delays=(3 9 15 15)  # Backoff delays in seconds
+
+  while [ $retry_count -lt $max_retries ]; do
+    pr_json=$(curl -sf \
+      -H "Authorization: Bearer $GITHUB_TOKEN" \
+      -H "Accept: application/vnd.github+json" \
+      "https://api.github.com/repos/$REPO/commits/$MERGE_COMMIT_SHA/pulls")
+
+    if [ $? -ne 0 ]; then
+      echo "Failed to fetch PR information for merge commit" >&2
+      exit 1
+    fi
+
+    # Check if we got any PRs
+    pr_count=$(echo "$pr_json" | jq 'length')
+    if [ "$pr_count" -gt 0 ]; then
+      echo "Found $pr_count PR(s) for merge commit"
+      break
+    fi
+
+    retry_count=$((retry_count + 1))
+    if [ $retry_count -lt $max_retries ]; then
+      # Get the appropriate backoff delay
+      delay_index=$((retry_count - 1))
+      if [ $delay_index -ge ${#backoff_delays[@]} ]; then
+        delay_index=$((${#backoff_delays[@]} - 1))
+      fi
+      delay=${backoff_delays[$delay_index]}
+      echo "No PRs found yet (attempt $retry_count/$max_retries), retrying in $delay seconds..."
+      sleep $delay
+    fi
+  done
+
+  if [ -z "$pr_json" ] || [ "$(echo "$pr_json" | jq 'length')" -eq 0 ]; then
+    echo "No PRs found for merge commit after $max_retries attempts" >&2
+    echo "This might be a direct push (not from a PR merge)" >&2
+    exit 1
+  fi
+
+  # Extract the head SHA from the PR that was actually merged (state: closed, merged_at != null)
+  # We prefer the PR whose merge_commit_sha matches our MERGE_COMMIT_SHA
+  HEAD_SHA=$(echo "$pr_json" | jq -r --arg merge_sha "$MERGE_COMMIT_SHA" '
+    map(select(.state == "closed" and .merged_at != null))
+    | map(select(.merge_commit_sha == $merge_sha))
+    | .[0].head.sha
+  ')
+
+  # If no exact match, fall back to the first merged PR
+  # This is useful for keeping codecov updated in case of direct pushes
+  if [ -z "$HEAD_SHA" ] || [ "$HEAD_SHA" = "null" ]; then
+    echo "No exact merge commit match, trying first merged PR..."
+    HEAD_SHA=$(echo "$pr_json" | jq -r '
+      map(select(.state == "closed" and .merged_at != null))
+      | .[0].head.sha
+    ')
+  fi
+
+  if [ -z "$HEAD_SHA" ] || [ "$HEAD_SHA" = "null" ]; then
+    echo "No merged PR found for commit $MERGE_COMMIT_SHA" >&2
+    echo "PR JSON: $pr_json" >&2
+    exit 1
+  fi
+
+  echo "Found PR head SHA: $HEAD_SHA"
+else
+  HEAD_SHA="${HEAD_SHA:?HEAD_SHA environment variable is required when MERGE_COMMIT_SHA is not provided}"
+fi
+
+echo "Head SHA: $HEAD_SHA"
+echo "Current run id: $CURRENT_RUN_ID"
+echo "Artifact pattern: $ARTIFACT_NAME_PATTERN"
+echo "Workflow paths: $WORKFLOW_PATHS"
+
+# Get all PR runs for this commit (since its runs per SHA 500 should be enough for now)
+json=$(curl -sf \
+  -H "Authorization: Bearer $GITHUB_TOKEN" \
+  -H "Accept: application/vnd.github+json" \
+  "https://api.github.com/repos/$REPO/actions/runs?head_sha=$HEAD_SHA&event=pull_request&per_page=500")
+
+if [ $? -ne 0 ]; then
+  echo "Failed to fetch workflow runs" >&2
+  exit 1
+fi
+
+# Convert comma-separated workflow paths to JSON array for jq
+workflow_paths_array=$(echo "$WORKFLOW_PATHS" | jq -Rc 'split(",")')
+jq_exit_status=$?
+
+if [ $jq_exit_status -ne 0 ]; then
+  echo "ERROR: Failed to parse WORKFLOW_PATHS into JSON array (exit code: $jq_exit_status)" >&2
+  echo "WORKFLOW_PATHS: $WORKFLOW_PATHS" >&2
+  exit 1
+fi
+
+if [ -z "$workflow_paths_array" ]; then
+  echo "ERROR: workflow_paths_array is empty after jq processing" >&2
+  echo "WORKFLOW_PATHS: $WORKFLOW_PATHS" >&2
+  exit 1
+fi
+
+# Validate the result is valid JSON
+if ! echo "$workflow_paths_array" | jq empty 2>/dev/null; then
+  echo "ERROR: workflow_paths_array is not valid JSON" >&2
+  echo "Output: $workflow_paths_array" >&2
+  exit 1
+fi
+
+echo "Finding runs for workflows: $workflow_paths_array"
+
+# Find all completed & successful runs that are NOT this run and match our workflow paths
+run_ids=$(echo "$json" | jq -r --arg cur "$CURRENT_RUN_ID" --argjson workflows "$workflow_paths_array" '
+  .workflow_runs
+  | map(select(
+    .id != ($cur|tonumber)
+    and .status == "completed"
+    and .conclusion == "success"
+    and ([.path] | inside($workflows))
+  ))
+  | map(.id)
+  | unique
+  | .[]
+')
+jq_exit_status=$?
+
+if [ $jq_exit_status -ne 0 ]; then
+  echo "ERROR: Failed to extract run IDs from workflow runs JSON (exit code: $jq_exit_status)" >&2
+  echo "Input JSON (truncated to 500 chars):" >&2
+  echo "$json" | head -c 500 >&2
+  echo "" >&2
+  exit 1
+fi
+
+if [ -z "$run_ids" ]; then
+  echo "No previous successful PR runs found for $HEAD_SHA matching specified workflows"
+  echo "artifacts_json=[]" >> "$GITHUB_OUTPUT"
+  echo "has_artifacts=false" >> "$GITHUB_OUTPUT"
+  exit 0
+fi
+
+echo "Found run IDs: $run_ids"
+
+# Collect all matching artifacts from all runs
+all_artifacts="[]"
+
+for run_id in $run_ids; do
+  echo "Fetching artifacts for run id: $run_id"
+
+  # Get artifacts for that run
+  artifacts_json=$(curl -sf \
+    -H "Authorization: Bearer $GITHUB_TOKEN" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/$REPO/actions/runs/$run_id/artifacts")
+  curl_exit_status=$?
+
+  if [ $curl_exit_status -ne 0 ]; then
+    echo "ERROR: Failed to fetch artifacts for run $run_id (curl exit code: $curl_exit_status)" >&2
+    exit 1
+  fi
+
+  # Validate artifacts_json is valid JSON
+  if ! echo "$artifacts_json" | jq empty 2>/dev/null; then
+    echo "ERROR: Invalid JSON received from artifacts API for run $run_id" >&2
+    echo "Response (truncated to 500 chars):" >&2
+    echo "$artifacts_json" | head -c 500 >&2
+    echo "" >&2
+    exit 1
+  fi
+
+  # Find all artifacts matching the pattern
+  matching_artifacts=$(echo "$artifacts_json" | jq --arg pattern "$ARTIFACT_NAME_PATTERN" --arg run "$run_id" '
+    .artifacts
+    | map(select((.name | contains($pattern)) and .expired == false))
+    | map({
+        run_id: ($run | tonumber),
+        artifact_id: .id,
+        artifact_name: .name,
+        created_at: .created_at
+      })
+  ')
+  jq_exit_status=$?
+
+  if [ $jq_exit_status -ne 0 ]; then
+    echo "ERROR: Failed to extract matching artifacts for run $run_id (exit code: $jq_exit_status)" >&2
+    echo "Artifacts JSON (truncated to 500 chars):" >&2
+    echo "$artifacts_json" | head -c 500 >&2
+    echo "" >&2
+    exit 1
+  fi
+
+  # Validate matching_artifacts is valid JSON
+  if ! echo "$matching_artifacts" | jq empty 2>/dev/null; then
+    echo "ERROR: matching_artifacts is not valid JSON for run $run_id" >&2
+    echo "Output (truncated to 500 chars):" >&2
+    echo "$matching_artifacts" | head -c 500 >&2
+    echo "" >&2
+    exit 1
+  fi
+
+  # Merge with collected artifacts
+  all_artifacts=$(echo "$all_artifacts" | jq --argjson new "$matching_artifacts" '. + $new')
+  jq_exit_status=$?
+
+  if [ $jq_exit_status -ne 0 ]; then
+    echo "ERROR: Failed to merge artifacts for run $run_id (exit code: $jq_exit_status)" >&2
+    exit 1
+  fi
+done
+
+# Sort by created_at and ensure we have at least one artifact
+artifact_count=$(echo "$all_artifacts" | jq 'length' 2>/dev/null || echo "0")
+
+if [ -z "$artifact_count" ] || [ "$artifact_count" -eq 0 ]; then
+  echo "No non-expired artifacts matching pattern '$ARTIFACT_NAME_PATTERN' found"
+  echo "artifacts_json=[]" >> "$GITHUB_OUTPUT"
+  echo "has_artifacts=false" >> "$GITHUB_OUTPUT"
+  exit 0
+fi
+
+echo "Found $artifact_count matching artifacts"
+
+# Output the JSON array
+echo "$all_artifacts" | jq -c 'sort_by(.created_at)'
+
+# Write to GitHub output as a single-line JSON string with validation
+artifacts_output=$(echo "$all_artifacts" | jq -c 'sort_by(.created_at)')
+jq_exit_status=$?
+
+# Validate jq succeeded
+if [ $jq_exit_status -ne 0 ]; then
+  echo "ERROR: jq failed to process artifacts JSON (exit code: $jq_exit_status)" >&2
+  echo "Input JSON (truncated to 500 chars):" >&2
+  echo "$all_artifacts" | head -c 500 >&2
+  echo "" >&2
+  exit 1
+fi
+
+# Ensure output is non-empty
+if [ -z "$artifacts_output" ]; then
+  echo "ERROR: jq produced empty output" >&2
+  echo "Input JSON: $all_artifacts" >&2
+  exit 1
+fi
+
+# Validate output is parseable JSON
+if ! echo "$artifacts_output" | jq empty 2>/dev/null; then
+  echo "ERROR: jq produced invalid JSON" >&2
+  echo "Output (truncated to 500 chars):" >&2
+  echo "$artifacts_output" | head -c 500 >&2
+  echo "" >&2
+  exit 1
+fi
+
+# All validations passed, write to GitHub output
+echo "artifacts_json=$artifacts_output" >> "$GITHUB_OUTPUT"
+echo "has_artifacts=true" >> "$GITHUB_OUTPUT"
\ No newline at end of file
diff --git a/.github/scripts/find-pr-commit.sh b/.github/scripts/find-pr-commit.sh
new file mode 100755
index 0000000000..59ad84683d
--- /dev/null
+++ b/.github/scripts/find-pr-commit.sh
@@ -0,0 +1,87 @@
+#!/bin/bash
+
+# This script finds a PR commit for artifact lookup.
+# If the current commit is from a PR, it returns that.
+# Otherwise, it searches recent commits to find the last PR commit.
+#
+# Required environment variables:
+#   REPO: GitHub repository (e.g., owner/repo)
+#   CURRENT_SHA: The current commit SHA
+#   GITHUB_TOKEN: Required for API authentication
+#
+# Outputs (to $GITHUB_OUTPUT):
+#   merge_commit_sha: The commit SHA to use for artifact lookup
+#   skip: 'true' if no PR commit found, 'false' otherwise
+#
+
+REPO="${REPO:?REPO environment variable is required}"
+CURRENT_SHA="${CURRENT_SHA:?CURRENT_SHA environment variable is required}"
+
+echo "Checking if commit $CURRENT_SHA is from a PR..."
+
+# Check if current commit is from a merged PR
+pr_count=$(curl -sf \
+  -H "Authorization: Bearer $GITHUB_TOKEN" \
+  -H "Accept: application/vnd.github+json" \
+  "https://api.github.com/repos/$REPO/commits/$CURRENT_SHA/pulls" \
+  | jq 'map(select(.merged_at != null)) | length')
+
+if [ $? -ne 0 ]; then
+  echo "Failed to check PR status for current commit" >&2
+  exit 1
+fi
+
+echo "Found $pr_count merged PR(s) for current commit"
+
+if [ "$pr_count" -gt 0 ]; then
+  echo "Current commit is from a PR"
+  echo "merge_commit_sha=$CURRENT_SHA" >> "$GITHUB_OUTPUT"
+  echo "skip=false" >> "$GITHUB_OUTPUT"
+  exit 0
+fi
+
+echo "Current commit is not from a PR, searching for last PR commit..."
+
+# Get recent commits on main (up to 100)
+commits=$(curl -sf \
+  -H "Authorization: Bearer $GITHUB_TOKEN" \
+  -H "Accept: application/vnd.github+json" \
+  "https://api.github.com/repos/$REPO/commits?sha=main&per_page=100" \
+  | jq -r '.[].sha')
+
+if [ $? -ne 0 ]; then
+  echo "Failed to fetch recent commits" >&2
+  exit 1
+fi
+
+last_pr_commit=""
+for commit_sha in $commits; do
+  echo "Checking commit: $commit_sha"
+
+  pr_count=$(curl -sf \
+    -H "Authorization: Bearer $GITHUB_TOKEN" \
+    -H "Accept: application/vnd.github+json" \
+    "https://api.github.com/repos/$REPO/commits/$commit_sha/pulls" \
+    | jq 'map(select(.merged_at != null)) | length')
+
+  if [ $? -ne 0 ]; then
+    echo "Warning: Failed to check PR status for commit $commit_sha, skipping..." >&2
+    continue
+  fi
+
+  if [ "$pr_count" -gt 0 ]; then
+    echo "Found last PR commit: $commit_sha"
+    last_pr_commit="$commit_sha"
+    break
+  fi
+done
+
+if [ -z "$last_pr_commit" ]; then
+  echo "No PR commit found in recent history, skipping codecov upload"
+  echo "skip=true" >> "$GITHUB_OUTPUT"
+  exit 0
+fi
+
+echo "Using artifacts from PR commit: $last_pr_commit"
+echo "merge_commit_sha=$last_pr_commit" >> "$GITHUB_OUTPUT"
+echo "skip=false" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/cli-ci.yaml b/.github/workflows/cli-ci.yaml
index f66b63c41f..94e84f9f18 100644
--- a/.github/workflows/cli-ci.yaml
+++ b/.github/workflows/cli-ci.yaml
@@ -54,10 +54,15 @@ jobs:
       - name: Get Coverage
         run: pnpm run --filter wgc coverage
 
-      - name: Upload results to Codecov
-        uses: codecov/codecov-action@v5
+      - name: Upload Coverage to Codecov
+        uses: ./.github/actions/codecov-upload-pr
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          artifact-name: cli-one
+          coverage-path: |
+            cli/coverage/clover.xml
+            cli/coverage/coverage-final.json
+          retention-days: 7
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
 
   build_test_node_matrix:
     timeout-minutes: 10
@@ -114,4 +119,4 @@ jobs:
         run: exit 0
       - name: 'Some tests failed'
         if: ${{ contains(needs.*.result, 'failure') }}
-        run: exit 1
+        run: exit 1
\ No newline at end of file
diff --git a/.github/workflows/codecov-post-merge.yaml b/.github/workflows/codecov-post-merge.yaml
new file mode 100644
index 0000000000..6496de799f
--- /dev/null
+++ b/.github/workflows/codecov-post-merge.yaml
@@ -0,0 +1,41 @@
+name: Codecov Post-Merge
+on:
+  push:
+    branches:
+      - main
+
+env:
+  CI: true
+  DO_NOT_TRACK: '1'
+
+jobs:
+  upload-codecov:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Find PR commit for artifacts
+        id: find-pr-commit
+        shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
+          CURRENT_SHA: ${{ github.sha }}
+        run: ./.github/scripts/find-pr-commit.sh
+
+      - name: Print commit information
+        if: steps.find-pr-commit.outputs.skip != 'true'
+        run: |
+          echo "Current commit (for codecov): ${{ github.sha }}"
+          echo "PR commit (for artifacts): ${{ steps.find-pr-commit.outputs.merge_commit_sha }}"
+
+      - name: Download computed artifact and upload to codecov with merge SHA
+        if: steps.find-pr-commit.outputs.skip != 'true'
+        uses: ./.github/actions/codecov-merge-upload
+        with:
+          coverage-path: coverage
+          workflow-paths: .github/workflows/cli-ci.yaml,.github/workflows/router-ci.yaml
+          override-commit: ${{ github.sha }}
+          merge-commit-sha: ${{ steps.find-pr-commit.outputs.merge_commit_sha }}
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/router-ci.yaml b/.github/workflows/router-ci.yaml
index 035d7c5661..ca4197eea4 100644
--- a/.github/workflows/router-ci.yaml
+++ b/.github/workflows/router-ci.yaml
@@ -362,17 +362,33 @@ jobs:
         working-directory: ./router-tests
         run: make test-coverage test_retry_count=0 test_params="-run '^Test[^(Flaky)]' --timeout=5m -p 1 --parallel 10" test_target="${{ matrix.test_target }}"
 
+      - name: Compute artifact name for codecov upload
+        id: artifact_name
+        run: |
+          # Sanitize test target: remove './', replace spaces and special chars with underscores
+          target="${{ matrix.test_target }}"
+          sanitized=$(echo "$target" | sed 's|\.\/||g' | sed 's|[^a-zA-Z0-9]|_|g' | sed 's|_\+|_|g' | sed 's|^_||' | sed 's|_$||')
+          echo "sanitized=$sanitized" >> $GITHUB_OUTPUT
+
+      - name: Upload integration results to Codecov
+        uses: ./.github/actions/codecov-upload-pr
+        with:
+          artifact-name: router-${{ steps.artifact_name.outputs.sanitized }}-nonFlaky
+          coverage-path: router-tests/coverage.out
+          retention-days: 7
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
+
       - name: Run Flaky Integration tests ${{ matrix.test_target }}
         working-directory: ./router-tests
         run: make test-coverage test_retry_count=3 test_params="-run '^TestFlaky' --timeout=5m -p 1 --parallel 10" test_target="${{ matrix.test_target }}"
 
-      - name: Upload results to Codecov
-        uses: codecov/codecov-action@v5
+      - name: Upload flaky integration results to Codecov
+        uses: ./.github/actions/codecov-upload-pr
         with:
-          verbose: true
-          files: |
-            router-tests/coverage.out
-          token: ${{ secrets.CODECOV_TOKEN }}
+          artifact-name: router-${{ steps.artifact_name.outputs.sanitized }}-flaky
+          coverage-path: router-tests/coverage.out
+          retention-days: 7
+          codecov-token: ${{ secrets.CODECOV_TOKEN }}
 
   image_scan:
     if: github.event.pull_request.head.repo.full_name == github.repository
diff --git a/codecov.yaml b/codecov.yaml
index 56205d539c..364bc9884e 100644
--- a/codecov.yaml
+++ b/codecov.yaml
@@ -5,3 +5,8 @@ coverage:
         target: 90
         threshold: 5
         informational: true # We don't want to block PRs based on the result
+    project:
+      default:
+        target: 90
+        threshold: 5
+        informational: true