7 files changed, 157 insertions, 0 deletions
diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..d6cc384
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,8 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+inheritance: true
+
+knowledge_base:
+  jira:
+    project_keys:
+      - NOS
+      - VD
diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
new file mode 120000
index 0000000..be77ac8
--- /dev/null
+++ b/.github/copilot-instructions.md
@@ -0,0 +1 @@
+../AGENTS.md
+\ No newline at end of file
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 0000000..f6096b0
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,29 @@
+name: validate
+on:
+  pull_request:
+  push:
+    branches: [production]
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Audit egress
+        continue-on-error: true
+        uses: bullfrogsec/bullfrog@7bc9b6e13e2dd9cbe5861f33bc26dc6bdb9d9ed2   # v0.10.0
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Validate codecov.yml structure
+        run: |
+          set -euo pipefail
+          response=$(curl -sS --fail-with-body -X POST \
+            --connect-timeout 10 --max-time 60 \
+            --data-binary @codecov.yml \
+            https://codecov.io/validate)
+          echo "$response"
diff --git a/.mergify.yml b/.mergify.yml
new file mode 100644
index 0000000..c3877f5
--- /dev/null
+++ b/.mergify.yml
@@ -0,0 +1,4 @@
+extends: mergify
+
+merge_protections_settings:
+  reporting_method: check-runs
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..c81cf6e
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,21 @@
+# Repo context for AI assistants
+
+This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization.
+
+## What lives here
+- `codecov.yml` — the canonical, comment-free dashboard-paste payload. Mirror of
+  `https://app.codecov.io/account/gh/vyos/yaml`.
+- `.github/workflows/validate.yml` — required CI check; POSTs the file to
+  `https://codecov.io/validate` on every PR/push.
+- `.mergify.yml` — extends central [vyos/mergify](https://github.com/vyos/mergify).
+- `.coderabbit.yaml` — inherits from [vyos/coderabbit](https://github.com/vyos/coderabbit)
+  (`inheritance: true` is mandatory).
+- `README.md` — change protocol + dashboard-paste discipline.
+
+## Change protocol
+1. PRs only. No direct dashboard edits.
+2. Keep `codecov.yml` comment-free — Codecov strips comments on dashboard save; any
+   explanatory content lives here in AGENTS.md or in README.md.
+3. After merge to `production`, operator pastes from
+   `gh api repos/vyos/codecov/contents/codecov.yml?ref=production --jq '.content' | base64 -d`
+   into the dashboard. Repo is the source of truth; dashboard is a cache.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..9b91370
--- /dev/null
+++ b/README.md
@@ -0,0 +1,56 @@
+# vyos/codecov
+
+Codecov Global YAML for the `vyos` GitHub organization.
+
+This repo is the canonical source for the file rendered at
+[`https://app.codecov.io/account/gh/vyos/yaml`](https://app.codecov.io/account/gh/vyos/yaml).
+The dashboard is a cache; this repo's `production` branch is the source of truth.
+
+Sibling repo: [VyOS-Networks/codecov](https://github.com/VyOS-Networks/codecov) for the
+VyOS-Networks org. Both repos hold byte-identical `codecov.yml` at design time; any future
+delta is enumerated in the per-org delta table below — never as comments in `codecov.yml`
+(Codecov strips them on dashboard save).
+
+## Change protocol
+
+1. PRs only. No direct dashboard edits.
+2. PRs run the `validate` workflow which POSTs `codecov.yml` to
+   `https://codecov.io/validate`. The check must pass.
+3. After merge to `production`:
+   ```bash
+   gh api repos/vyos/codecov/contents/codecov.yml?ref=production \
+     --jq '.content' | base64 -d
+   ```
+   Operator pastes this content into the dashboard editor (linked above), saves,
+   and re-opens the tab to confirm the saved content matches.
+
+## Paste protocol (operator)
+
+1. Open https://app.codecov.io/account/gh/vyos/yaml in browser.
+2. Fetch the merged file via `gh api ... | base64 -d` (above).
+3. Paste into the dashboard editor.
+4. Save.
+5. Re-open the dashboard tab. **Codecov strips comments** — the saved content
+   should match the paste content because the file is comment-free.
+6. Capture the Codecov change-history audit-log row (timestamp, user, prior version)
+   to the IS ticket as evidence.
+7. Record merge commit SHA + paste timestamp + audit-log reference in the IS ticket.
+
+## Per-org delta (vyos vs VyOS-Networks)
+
+(none at the time of last update — both orgs paste byte-identical `codecov.yml`)
+
+## Language-applicability caveat
+
+The numeric thresholds (`project.threshold: 1%`, `patch.target: 70%`, `patch.threshold: 5%`)
+and the `ignore` patterns (`**/*.config.{ts,js,mjs,cjs}`, `**/*.d.ts`, `.next/`, `public/`)
+are Next.js-derived from the canary in [VyOS-Networks/next-js-vyos](https://github.com/VyOS-Networks/next-js-vyos).
+They are reasonable starting points for JS/TS repos and harmless for non-JS repos (the
+`ignore` patterns simply don't match Python/C++/Ansible paths and the thresholds apply to
+whatever does upload coverage). Repos in other languages that opt into Codecov should
+override numerics in their per-repo `.codecov.yml`.
+
+## Onboarding a new repo to Codecov coverage
+
+(deferred — see spec §9 follow-up; the playbook lives in `docs/per-repo-onboarding.md` once
+the first non-canary opt-in lands)
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 0000000..3c08860
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,38 @@
+codecov:
+  require_ci_to_pass: true
+
+coverage:
+  precision: 1
+  round: down
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 1%
+        informational: true
+        if_ci_failed: ignore
+        only_pulls: false
+    patch:
+      default:
+        target: 70%
+        threshold: 5%
+        informational: true
+        if_ci_failed: ignore
+
+comment:
+  layout: "header, diff, flags, files"
+  behavior: default
+  require_changes: false
+  require_base: no
+  require_head: yes
+
+ignore:
+  - "tests/"
+  - "scripts/"
+  - "**/*.config.ts"
+  - "**/*.config.js"
+  - "**/*.config.mjs"
+  - "**/*.config.cjs"
+  - "**/*.d.ts"
+  - ".next/"
+  - "public/"