Add test coverage measurement and CodeCov upload to CI

- Add --cov-report=xml to the pytest command in tox.ini so pytest-cov
  generates coverage.xml on every test run.
- Install git-core (minimal git package) in the CI container so the
  codecov action can read repository metadata.
- Add permissions: id-token: write to the tests job for OIDC token access.
- Add codecov/codecov-action@v5 step to upload coverage.xml to CodeCov.

Generated-By: OpenCode (google-vertex-anthropic/claude-sonnet-4-6@default)

Author: Agent

.github/workflows/gating.yaml

@@ -10,6 +10,8 @@ jobs:
   tests:
 
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     container:
       image: quay.io/exd-guild-compose/cts:latest
 
@@ -20,6 +22,7 @@ jobs:
           sudo dnf update -y &&
           sudo dnf install -y
           findutils
+          git-core
           make
           python3-ldap
           python3-mock
@@ -35,3 +38,9 @@ jobs:
         run: tox -e docs
       - name: tests
         run: tox -e py3
+      - uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          flags: unit-tests
+          files: ./coverage.xml
+          fail_ci_if_error: false

tox.ini

@@ -19,6 +19,7 @@ commands =
         -W "ignore:inspect.getargspec:DeprecationWarning" \
         -W "ignore:This method will be removed in future versions.  Use 'parser.read_file()':DeprecationWarning" \
         -W "ignore:Use .persist_selectable:DeprecationWarning" \
+        --cov-report=xml \
         {posargs}
 sitepackages = True