chore: send test coverage to Codecov

.github/workflows/ci.yml

@@ -56,9 +56,23 @@ jobs:
         run: uv run vulture
 
       # The e2e tier needs a running DSS; the `e2e` marker keeps it out of the
-      # default run (pyproject.toml). Coverage is printed, not gated.
+      # default run (pyproject.toml). Coverage is printed and sent to Codecov,
+      # not gated. The XML report is written here only, not on local runs.
       - name: Test
-        run: uv run pytest
+        run: uv run pytest --cov-report=xml
+
+      # `!cancelled()`: a failing run is when the line-by-line report helps most.
+      # The job still fails; this only keeps the report.
+      - name: Upload coverage to Codecov
+        if: ${{ !cancelled() }}
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          # Named explicitly: without it Codecov resolves the repo from the token
+          # alone, which fails with an unclear "Repository not found".
+          slug: ${{ github.repository }}
+          files: ./coverage.xml
+          fail_ci_if_error: true
 
   # Not on pull requests: one has already had every check, and an image it will
   # never publish would cost a build on every push.

.github/workflows/security.yml

@@ -0,0 +1,51 @@
+name: Security
+
+# Scans uv.lock for known CVEs.
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Trivy cache date
+        id: trivy-date
+        run: echo "date=$(date -u +%F)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Trivy binary and vulnerability DB
+        uses: actions/cache@v4
+        with:
+          path: |
+            bin/trivy
+            ~/.cache/trivy
+          key: trivy-${{ runner.os }}-${{ runner.arch }}-${{ steps.trivy-date.outputs.date }}
+          restore-keys: |
+            trivy-${{ runner.os }}-${{ runner.arch }}-
+
+      - name: Install Trivy (if not cached)
+        run: |
+          if [ ! -x bin/trivy ]; then
+            mkdir -p bin
+            curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b bin
+          fi
+
+      # Gates the build: the README carries a Security badge, and a green badge
+      # has to mean "no fixable HIGH/CRITICAL CVEs", not merely "the scan ran".
+      # --ignore-unfixed keeps the gate actionable — it only fires when an
+      # upgrade is actually available.
+      - name: Trivy dependency scan
+        run: |
+          ./bin/trivy fs \
+            --scanners vuln \
+            --exit-code 1 \
+            --severity HIGH,CRITICAL \
+            --ignore-unfixed \
+            --no-progress \
+            .

README.md

@@ -1,5 +1,8 @@
 # experience-api
 
+[![codecov](https://codecov.io/gh/OpenAgriNet/experience-api/graph/badge.svg?token=f0PYgnH6iO)](https://codecov.io/gh/OpenAgriNet/experience-api)
+[![Security](https://github.com/OpenAgriNet/experience-api/actions/workflows/security.yml/badge.svg?branch=main)](https://github.com/OpenAgriNet/experience-api/actions/workflows/security.yml)
+
 The Experience API sits between the OpenAgriNet web client and the Decision
 Support System (DSS). The client sends a chat turn; the API builds a DSS
 request, calls the DSS, and streams the answer back.