[Denis-Averin]

Part of the unified coverage change across all Aspose.BarCode Cloud SDKs; the shared scripts and docs are in aspose-barcode-cloud/aspose-barcode-cloud-codegen (branch unified-coverage, see doc/test-coverage-requirements.md there).

What changes

• make cover ends in scripts/coverage.py (copied from codegen, identical in every SDK): it prints Line coverage: NN.NN% (covered/total lines, threshold: 80%), applies COVERAGE_THRESHOLD (default 80) and writes coverage/coverage-badge.json and coverage/coverage-summary.json.
• The workflow gets permissions: contents: read at the top level; CI never writes to this repository. The job that runs make cover uploads the badge, the summary and the native report as a workflow artifact and has no credentials.
• A new publish-coverage job runs only on push to the default branch, and only while the organization variable COVERAGE_APP_ID exists; on pull requests and until the app is configured it is skipped. It downloads the artifact, takes a short-lived token for aspose-barcode-cloud/test-coverage from actions/create-github-app-token (limited to that repository and to contents: write) and runs scripts/publish-coverage.bash <sdk>, which commits <sdk>/coverage-badge.json, <sdk>/summary.json and the native report there. The token goes to git through the environment, not through the remote URL or argv.
• README gets a coverage badge: a shields.io endpoint badge reading test-coverage/main/<sdk>/coverage-badge.json. The badge line also lives in the codegen README template, so regeneration keeps it (checked: regenerating from codegen leaves no diff here).

Before the first publish

An organization admin creates the public test-coverage repository, a GitHub App with Contents: read and write installed only on that repository, the organization variable COVERAGE_APP_ID and the secret COVERAGE_APP_PRIVATE_KEY (both limited to the SDK repositories). Steps are in doc/test-coverage-requirements.md in codegen. Merging before that is fine: the publish job is skipped and the badge shows an error until the first publish.

SDK specifics

• make cover writes coverage/coverage.xml (+ HTML in coverage/html) and runs scripts/coverage.py cobertura; make test runs it. .coveragerc fail_under = 80 stays. make cover no longer passes -Werror (the unittest target still does).
• The artifact is uploaded from the Python 3.12 matrix entry.
• CI on this PR: 88.15% (3.12) / 87.96% (3.9). Without credentials: 87.03%.

Notes

• Live API tests were not run locally (no access to the API); CI runs them with TEST_CONFIGURATION_ACCESS_TOKEN as before, and they pass on this PR.
• The publish path was tested against a local bare repository (empty repository, second SDK, rejected push with retry); the GitHub App token flow runs for the first time on the first default-branch push after setup.

---

Generated by Claude Code