ci: upload coverage reports to github

[Vincent Biret (baywet)]

Motivation & Context

Configure CI coverage output for GitHub's native code coverage ingestion so coverage data is available directly from workflow runs for .NET and Python changes.

Description & Review Guide

• What are the major changes?
  • Upload the generated .NET Cobertura coverage report with actions/upload-code-coverage.
  • Upload the existing Python coverage XML report with actions/upload-code-coverage.
  • Grant the workflows the required code-quality: write and pull-requests: read permissions.
• What is the impact of these changes?
  • Coverage reports can be ingested by GitHub for same-repository PRs and default-branch runs without changing the existing threshold checks or artifact uploads.
• What do you want reviewers to focus on?
  • Whether the upload conditions and labels match the desired coverage ingestion behavior for both .NET and Python.

Related Issue

No linked issue. No overlapping open PR was found for this coverage ingestion setup.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Adds native GitHub coverage ingestion for .NET and Python CI workflows.

Changes:

• Grants required code-quality permissions.
• Uploads Cobertura/XML coverage reports with language-specific labels.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/python-test-coverage.yml	Adds Python coverage upload.
.github/workflows/dotnet-build-and-test.yml	Adds .NET coverage upload.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): e22aec32c010
Model: gpt-5.6-sol

Overview

The review found 4 verified inline finding(s).

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
4 verified findings remained after source verification (1 high, 3 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: .github/workflows/dotnet-build-and-test.yml, .github/workflows/python-test-coverage.yml

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[github-actions]

MAF Automated Review — Iteration 2

Result: Findings reported
Scope: 5 net-new commit(s): b901269d33da, d9799694e150, 7c728e0fe0c2, 757f2a83c3b2, aa01b7eec467
Model: gpt-5.6-sol

Overview

The revision now generates the expected .NET Cobertura file, uploads artifacts before native ingestion, and keeps coverage-write permission out of the jobs that execute repository code. However, the privileged upload jobs are still defined by same-repository PR branches, so those branches can alter the jobs and use their write token directly. Replacing the trusted Python reporter also removes the only coverage feedback path for fork and Dependabot PRs, which native ingestion intentionally excludes.

Reviewed the supplied incremental change set across correctness, security/reliability, architecture, and failure behavior.
2 verified findings remained after source verification (2 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: .github/workflows/python-test-coverage.yml

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.