ci: upload coverage to codecov.io

Add Codecov integration to the summary workflow to upload combined
coverage report (ut_cov_total.info) for the spdk/spdk repository.

- Use OIDC authentication (no static token needed)
- Use override_commit to map coverage to the tested SPDK commit
- Use disable_search to only upload the specified file
- Add permissions block to gerrit-webhook-handler.yml so the
  id-token:write permission propagates to the summary workflow

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <noreply@cognition.ai>
Signed-off-by: Boris Glimcher <Boris.Glimcher@emc.com>

Author: glimchb

.github/workflows/gerrit-webhook-handler.yml

@@ -35,6 +35,11 @@ on:
     - wip-state-changed
     - private-state-changed
 
+permissions:
+  actions: write  # Required for gh run cancel in patch_set_status
+  id-token: write # Required for Codecov OIDC in the summary workflow
+  contents: read
+
 env:
   # TODO: Renable client_payload for workflow_dispatch
   client_payload: ${{ github.event.client_payload != '' && toJson(github.event.client_payload) || '' }}

.github/workflows/summary.yml

@@ -13,6 +13,10 @@ on:
         type: string
         default: 'failure'
 
+permissions:
+  id-token: write # This is required for requesting the JWT
+  contents: read  # This is required for actions/checkout
+
 jobs:
   merge_outputs:
     # 22.04 used on purpose; it has lcov+gcov versions that are compatible with what
@@ -53,13 +57,25 @@ jobs:
         sudo apt-get update && sudo apt-get install -y lcov python3-pandas
         ./spdk/autorun_post.py -d ./_autorun_summary -r ./spdk
         echo "result=success" >> "$GITHUB_OUTPUT"
+        echo "spdk_sha=$(git -C ./spdk rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
     - name: Upload artifacts
       if: ${{ always() }}
       uses: actions/upload-artifact@v4.4.0
       with:
         name: _autorun_summary
         path: _autorun_summary
+
+    - name: Upload coverage to Codecov
+      uses: codecov/codecov-action@v5.5.2
+      with:
+        fail_ci_if_error: true
+        use_oidc: true
+        disable_search: true
+        files: ./_autorun_summary/ut_coverage/ut_cov_total.info
+        override_commit: ${{ steps.autorun_post.outputs.spdk_sha }}
+        slug: spdk/spdk
+
     outputs:
       result: ${{ steps.autorun_post.outputs.result }}