chore: refresh Codecov integration (action v5, yaml, app docs)

- Use codecov/codecov-action@v5 and explicit contents:read permission
- Add codecov.yml for informational status and PR comment layout
- Document Codecov GitHub App install in CI.md for reliable uploads/comments

Made-with: Cursor

Author: KaelSensei

.github/workflows/coverage.yml

@@ -15,6 +15,8 @@ jobs:
   coverage:
     name: "Forge Coverage → Codecov"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
@@ -47,7 +49,7 @@ jobs:
             || echo "lcov --remove returned non-zero (ok if nothing to remove)"
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v5
         with:
           files: lcov.info
           flags: foundry

CI.md

@@ -102,9 +102,19 @@ codecov-action → codecov.io
 - **PR annotations** — Codecov comments on PRs showing coverage diff
 - **Dashboard** at https://codecov.io/gh/KaelSensei/solidity-dojo with per-file breakdown
 
+### Codecov GitHub App (recommended)
+
+Codecov shows warnings such as *“install the Codecov app … to ensure uploads and comments are reliably processed”* when the repo is not linked via the official integration.
+
+1. Install the app for this org or repo: **[Codecov on GitHub Marketplace](https://github.com/marketplace/codecov)** (or **GitHub → Settings → Integrations → Applications → Codecov**).
+2. In **[codecov.io](https://codecov.io)** open this repository and confirm it is connected to **GitHub** (not “token only”).
+3. Re-run the **Coverage** workflow on a PR; uploads and PR comments should then be processed consistently.
+
+Repository YAML: root **`codecov.yml`** configures non-blocking status checks and PR comment layout.
+
 ### Required secret
 
-`CODECOV_TOKEN` must be set in **GitHub → Settings → Secrets → Actions**.
+`CODECOV_TOKEN` must be set in **GitHub → Settings → Secrets and variables → Actions** (still required for uploads from Actions unless you switch to [OIDC](https://docs.codecov.com/docs/github-oidc)).
 
 The coverage report is non-blocking — a drop in coverage does not fail the CI.
 

PROGRESS.md

@@ -8,6 +8,7 @@ A hands-on Solidity training ground based on solidity-by-example.org.
 
 - [x] **Naming / NatSpec cleanup (2026-04)**: After Slither-oriented renames, fixed shadowing bugs (`value = value`, `num = num`), aligned bodies with new parameter names, removed drift-prone `/// @param` lines under `src/` (excluding `src/hacks/`), added `scripts/strip_natspec_params.py`, and updated tests (`ERC20Permit`, `GasGolf`, `Immutable`). Full suite green via `forge test` in Docker.
 - [x] **Slither / Code Scanning (zero address)**: Added `require(... != address(0), "Zero address")` on low-level call entry points flagged in PR review (`Call`, `SendingEther`, `TryCatch`, `Payable.withdrawTo`, `Immutable` constructor, `Delegatecall` proxy + demo), with matching revert tests.
+- [x] **Codecov**: Upgraded `codecov/codecov-action` to v5, added root `codecov.yml` (informational checks, PR comment layout), documented installing the [Codecov GitHub App](https://github.com/marketplace/codecov) in `CI.md` for reliable uploads and PR comments.
 
 ### ✅ Phase 1: Project Setup
 - [x] Copy training documentation to repo

codecov.yml

@@ -0,0 +1,23 @@
+# https://docs.codecov.com/docs/codecov-yaml
+# PR comments and reliable uploads work best when the Codecov GitHub App is
+# installed on this repository (Settings → Integrations on codecov.io).
+
+codecov:
+  require_ci_to_pass: false
+
+coverage:
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true
+
+comment:
+  layout: "reach,diff,flags,tree,footer"
+  behavior: default
+  require_changes: false
+
+github_checks:
+  annotations: true