ci: add Codecov, SonarCloud and Codacy badges

.github/workflows/ci.yml

@@ -44,11 +44,58 @@ jobs:
         run: Set-MpPreference -DisableRealtimeMonitoring $true
       - run: cargo fmt --check
       - run: cargo clippy --all-targets --locked -- -D warnings
+      # Coverage needs llvm-tools and a prebuilt cargo-llvm-cov, with no fallback to compiling it.
+      - if: runner.os == 'Linux'
+        run: rustup component add llvm-tools
+      - if: runner.os == 'Linux'
+        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        with:
+          tool: cargo-llvm-cov@0.9.1
+          fallback: none
       # Timing-bounded tests (1 s and 5 s durable-write and retirement budgets) fail closed when the
       # runner is contended: Windows runs them serially, Linux on two threads. Temporary files stay
       # on the workspace drive: a durable write's median was 6 to 9 ms on the Windows system drive
       # and 0.2 to 0.6 ms there (3 runners, 30 October 2026).
-      - run: cargo test --locked -- --test-threads=${{ matrix.os == 'windows-latest' && 1 || 2 }}
+      - if: runner.os == 'Windows'
+        run: cargo test --locked -- --test-threads=1
         env:
           TEMP: ${{ runner.temp }}
           TMP: ${{ runner.temp }}
+      # The Linux leg runs the same tests under cargo-llvm-cov for the Codecov report.
+      - if: runner.os == 'Linux'
+        run: cargo llvm-cov --locked --lcov --output-path coverage-rust.lcov -- --test-threads=2
+        env:
+          TEMP: ${{ runner.temp }}
+          TMP: ${{ runner.temp }}
+      - if: runner.os == 'Linux'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: coverage-rust
+          path: coverage-rust.lcov
+          retention-days: 1
+
+  # The upload runs apart from the tests so the OIDC token is never available
+  # while test code runs. A Codecov outage fails only this job.
+  codecov:
+    name: upload coverage to Codecov
+    needs: check
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    continue-on-error: true
+    permissions:
+      contents: read
+      id-token: write # Authenticate the Codecov upload with OIDC; no stored token.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: coverage-rust
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
+        with:
+          use_oidc: true
+          files: coverage-rust.lcov
+          disable_search: true
+          fail_ci_if_error: true

CITATION.cff

@@ -5,8 +5,8 @@ type: software
 authors:
   - name: "EquityBot"
 abstract: "Ask ChatGPT, or the OpenAI or Azure OpenAI API, about your source files from a CLI or MCP server, and keep each answer as a durable session. A Rust port of Calvino."
-repository-code: "https://github.com/EquityBot/Industrious"
-license-url: "https://github.com/EquityBot/Industrious/blob/main/LICENSE"
+repository-code: "https://github.com/EquityBot/Alcuin"
+license-url: "https://github.com/EquityBot/Alcuin/blob/main/LICENSE"
 keywords:
   - azure-openai
   - chatgpt

CONTRIBUTING.md

@@ -0,0 +1,29 @@
+# Contributing
+
+Report bugs and request features in
+[GitHub issues](https://github.com/EquityBot/Alcuin/issues). For a suspected
+security vulnerability, follow [SECURITY.md](SECURITY.md) instead of opening an
+issue.
+
+## Pull requests
+
+Propose changes as a pull request against `main`. A change lands on `main` only
+when the `check (ubuntu-latest)` and `check (windows-latest)` checks from
+[ci.yml](.github/workflows/ci.yml) and the `Attribution policy` check pass. The
+attribution check fails a pull request whose title, commit trailers or
+identities credit an AI tool.
+
+Run what CI runs before opening one:
+
+```bash
+cargo fmt --check
+cargo clippy --all-targets --locked -- -D warnings
+cargo test --locked
+```
+
+New functionality and bug fixes come with automated tests, in `tests/` or the
+module's `#[cfg(test)]` tests, run by `cargo test --locked` in CI.
+
+CI runs the offline tests only. Tests that need a signed-in browser or a live
+provider are marked `#[ignore]` and run only on request, with your own
+accounts.

README.md

@@ -9,8 +9,8 @@
 
 <div align="center">
 
-[![tests](https://github.com/EquityBot/Industrious/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/EquityBot/Industrious/actions/workflows/ci.yml) [![CodeQL](https://github.com/EquityBot/Industrious/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/EquityBot/Industrious/actions/workflows/codeql.yml) [![Snyk](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml)<br>
-[![OpenSSF Scorecard](https://raw.githubusercontent.com/ryanduguid/.github/badges/EquityBot/Industrious.svg)](https://scorecard.dev/viewer/?uri=github.com/EquityBot/Industrious)<br>
+[![tests](https://github.com/EquityBot/Alcuin/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/ci.yml) [![Codecov](https://codecov.io/gh/EquityBot/Alcuin/graph/badge.svg)](https://codecov.io/gh/EquityBot/Alcuin) [![CodeQL](https://github.com/EquityBot/Alcuin/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/codeql.yml) [![Snyk](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/EquityBot/Alcuin/actions/workflows/snyk.yml) [![SonarCloud](https://sonarcloud.io/api/project_badges/measure?project=EquityBot_Industrious&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=EquityBot_Industrious) [![Codacy code quality](https://app.codacy.com/project/badge/Grade/64b01c5d3b174763951ce4fa40124a84)](https://app.codacy.com/gh/EquityBot/Alcuin/dashboard)<br>
+[![OpenSSF Scorecard](https://raw.githubusercontent.com/ryanduguid/.github/badges/EquityBot/Alcuin.svg)](https://scorecard.dev/viewer/?uri=github.com/EquityBot/Alcuin)<br>
 [![rust: 1.99+](.github/assets/badges/rust.svg)](https://www.rust-lang.org/) [![licence: FSL-1.1-ALv2](.github/assets/badges/licence.svg)](LICENSE)
 
 </div>

codecov.yml

@@ -0,0 +1,11 @@
+# Codecov reports coverage for the README badge. Its statuses are
+# informational, so it never decides a merge, and it posts no comments.
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
+comment: false

llms.txt

@@ -9,13 +9,13 @@ Version 0.1.0 (unreleased). Needs Rust 1.99 or later; install from a checkout wi
 
 ## Start
 
-- [README](https://github.com/EquityBot/Industrious#readme): install, use, settings and known limitations.
-- [SECURITY.md](https://github.com/EquityBot/Industrious/blob/main/SECURITY.md): what Industrious can reach and how to report a vulnerability.
+- [README](https://github.com/EquityBot/Alcuin#readme): install, use, settings and known limitations.
+- [SECURITY.md](https://github.com/EquityBot/Alcuin/blob/main/SECURITY.md): what Industrious can reach and how to report a vulnerability.
 
 ## Docs
 
-- [CHANGELOG.md](https://github.com/EquityBot/Industrious/blob/main/CHANGELOG.md): changes in each release.
-- [NOTICE](https://github.com/EquityBot/Industrious/blob/main/NOTICE): licence terms and Oracle's retained MIT notice.
+- [CHANGELOG.md](https://github.com/EquityBot/Alcuin/blob/main/CHANGELOG.md): changes in each release.
+- [NOTICE](https://github.com/EquityBot/Alcuin/blob/main/NOTICE): licence terms and Oracle's retained MIT notice.
 
 ## Related