Create a new codecov module for scorecard

Scorecard is a backstage plugin and supports multiple metric, grouped as modules in folder workspaces/scorecard/plugins.

There are already modules that support GitHub, OpenSSF, SonarQube. Add a new module for codecov that provide the following metrics:

1. Code coverage (Current percentage value for the default branch)
2. Code coverage - Trend for the last 7 days
3. Code coverage - Tracked files
4. Code coverage - Tracked lines of code
5. Code coverage - Covered lines of code
6. Code coverage - Partial covered lines of code
7. Code coverage - Missed lines of code

The metrics providers should introduce multiple new Backstage entity annotations:

• codecov.io/account (string, optional)
• codecov.io/service (string, optional)
• codecov.io/owner (string, optional)
• codecov.io/repo (string, required to enable the codecov metrics)

All metrics providers should filter for entities with annotation codecov.io/repo.

To get the coverage from codecov.io, the backend module needs to know for which entities and codecov services it needs to communicate.

For this the backend should support multiple codecov accounts like this:

codecov:
  defaultAccount: default
  accounts:
    - name: default
      authToken: example

The authToken needs to picked up from this accounts array by the name. The account name can be specified in the annotation codecov.io/account. The default account name can be changed in the configuration. This configuration parameter should be optional. If its not specified then the default account name should use "default".

The only necessary API to get all information for all metrics is documented on https://docs.codecov.com/reference/repos_retrieve

https://api.codecov.io/api/v2/{service}/{owner_username}/repos/{repo_name}/

The authToken needs to be provided as header, but its optional and should not use it when no token is specified.

Authorization: bearer {{ ACCESS TOKEN }}

The call includes a service name, an owner username and a repo name.

• service should prefer the annotation codecov.io/service, when its not defined it should automatically use github if github.com/slug annotation is defined. It should fail otherwise. Other cases might be added in the future.
• owner username should prefer the annotation codecov.io/owner. When its not defined it should try to extract an owner from codecov.io/repo when it's include a slash (/). It should fail if owner is defined and repo doesn't include a slash.
• repo name should prefer the annotation codecov.io/repo. When its not defined it should try to extract an owner from codecov.io/repo when it's include a slash (/).

Here is a working example API call:

curl --header 'accept: application/json' 'https://api.codecov.io/api/v2/github/redhat-developer/repos/rhdh-plugins'

This generated an out like this:

{
  "name": "rhdh-plugins",
  "private": false,
  "updatestamp": "2026-06-19T10:29:51.283089Z",
  "author": {
    "service": "github",
    "username": "redhat-developer",
    "name": "redhat-developer"
  },
  "language": "typescript",
  "branch": "main",
  "active": true,
  "activated": true,
  "totals": {
    "files": 2252,
    "lines": 85789,
    "hits": 45982,
    "misses": 38246,
    "partials": 1561,
    "coverage": 53.59,
    "branches": 24121,
    "methods": 13480,
    "sessions": 23,
    "complexity": 0.0,
    "complexity_total": 0.0,
    "complexity_ratio": 0,
    "diff": 0
  }
}

When possible the API call response should be reused between all seven metric providers.

It is not neccessary to use a codecov dependency for this, a simple fetch call should work.

Add a type definition for the codecov response

Add tests and integrate the new module into the existing Backstage app. Add an example entity for rhdh-plugins with the annotation codecov.io/repo: redhat-developer/rhdh-plugins.