Create a new codecov module for scorecard

[christoph-jerolimov]

Scorecard is a backstage plugin and supports multiple metric, grouped as modules in folder workspaces/scorecard/plugins.

There are already modules that support GitHub, OpenSSF, SonarQube. Add a new module for codecov that provide the following metrics:

1. Code coverage (Current percentage value for the default branch)
2. Code coverage - Trend for the last 7 days
3. Code coverage - Tracked files
4. Code coverage - Tracked lines of code
5. Code coverage - Covered lines of code
6. Code coverage - Partial covered lines of code
7. Code coverage - Missed lines of code

The metrics providers should introduce multiple new Backstage entity annotations:

• codecov.io/account (string, optional)
• codecov.io/service (string, optional)
• codecov.io/owner (string, optional)
• codecov.io/repo (string, required to enable the codecov metrics)

All metrics providers should filter for entities with annotation codecov.io/repo.

To get the coverage from codecov.io, the backend module needs to know for which entities and codecov services it needs to communicate.

For this the backend should support multiple codecov accounts like this:

codecov:
  defaultAccount: default
  accounts:
    - name: default
      authToken: example

The authToken needs to picked up from this accounts array by the name. The account name can be specified in the annotation codecov.io/account. The default account name can be changed in the configuration. This configuration parameter should be optional. If its not specified then the default account name should use "default".

The only necessary API to get all information for all metrics is documented on https://docs.codecov.com/reference/repos_retrieve

https://api.codecov.io/api/v2/{service}/{owner_username}/repos/{repo_name}/

The authToken needs to be provided as header, but its optional and should not use it when no token is specified.

Authorization: bearer {{ ACCESS TOKEN }}

The call includes a service name, an owner username and a repo name.

• service should prefer the annotation codecov.io/service, when its not defined it should automatically use github if github.com/slug annotation is defined. It should fail otherwise. Other cases might be added in the future.
• owner username should prefer the annotation codecov.io/owner. When its not defined it should try to extract an owner from codecov.io/repo when it's include a slash (/). It should fail if owner is defined and repo doesn't include a slash.
• repo name should prefer the annotation codecov.io/repo. When its not defined it should try to extract an owner from codecov.io/repo when it's include a slash (/).

Here is a working example API call:

curl --header 'accept: application/json' 'https://api.codecov.io/api/v2/github/redhat-developer/repos/rhdh-plugins'

This generated an out like this:

{
  "name": "rhdh-plugins",
  "private": false,
  "updatestamp": "2026-06-19T10:29:51.283089Z",
  "author": {
    "service": "github",
    "username": "redhat-developer",
    "name": "redhat-developer"
  },
  "language": "typescript",
  "branch": "main",
  "active": true,
  "activated": true,
  "totals": {
    "files": 2252,
    "lines": 85789,
    "hits": 45982,
    "misses": 38246,
    "partials": 1561,
    "coverage": 53.59,
    "branches": 24121,
    "methods": 13480,
    "sessions": 23,
    "complexity": 0.0,
    "complexity_total": 0.0,
    "complexity_ratio": 0,
    "diff": 0
  }
}

When possible the API call response should be reused between all seven metric providers.

It is not neccessary to use a codecov dependency for this, a simple fetch call should work.

Add a type definition for the codecov response

Add tests and integrate the new module into the existing Backstage app. Add an example entity for rhdh-plugins with the annotation codecov.io/repo: redhat-developer/rhdh-plugins.

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 11:59 AM UTC · Completed 12:01 PM UTC
Commit: 7ccaff1 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Category: Feature · Severity: Medium

Problem

The Scorecard plugin lacks a Codecov integration module. This issue requests a new scorecard-backend-module-codecov plugin that surfaces 7 code coverage metrics from the Codecov API.

Assessment

This issue is thoroughly specified with all implementation details needed:

• API: Single Codecov endpoint (/api/v2/{service}/{owner}/repos/{repo}/) with sample response
• Configuration: Multi-account YAML schema with auth tokens
• Annotations: 4 new entity annotations with clear resolution/fallback logic
• Metrics: 7 distinct metrics derived from the API response's totals object
• Patterns: Existing modules (github, openssf, sonarqube) in the same workspace provide implementation templates

Recommended Approach

1. Create scorecard-backend-module-codecov following the structure of existing modules
2. Implement the config schema with multi-account support and default account fallback
3. Build annotation resolution logic (service from github.com/slug, owner/repo parsing from slash-separated values)
4. Create 7 metric providers that share a single cached API response per entity
5. Add type definitions for the Codecov API response
6. Add tests and wire up the example entity

Proposed Test Case

- Mock the Codecov API response with the sample data from this issue
- Verify all 7 metrics extract correct values (coverage=53.59, files=2252, lines=85789, hits=45982, partials=1561, misses=38246)
- Test annotation fallback: no codecov.io/service + github.com/slug present → service='github'
- Test owner/repo parsing from 'redhat-developer/rhdh-plugins' format
- Test default account selection when codecov.io/account annotation is absent
- Test auth header omission when no token is configured
- Verify API response is fetched once and shared across all 7 metric providers

---

Labels: This is a feature request for the scorecard workspace, matching the workspace/scorecard and scorecard area labels, and enhancement for new feature type.

[christoph-jerolimov]

/fs-code

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 12:48 PM UTC · Completed 1:28 PM UTC
Commit: 7ccaff1 · View workflow run →