ci: add a coverage check at end of unit tests

It's currently set to require all new & modified code to be fully
covered. And to allow the current coverage score of 94% in general.

.github/workflows/ci.yaml

@@ -19,14 +19,15 @@ jobs:
     runs-on: ubuntu-22.04
     strategy:
       matrix:
-        # while we are still private, don't go crazy with the Python versions as they eat up CI minutes
+        # Don't go crazy with the Python versions as the test suite is a beast.
+        # Just test the minimum version we support.
         python-version: ["3.10"]
 
     steps:
       - uses: actions/checkout@v4
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -55,7 +56,17 @@ jobs:
 
       - name: Test with pytest
         run: |
-          python -m pytest
+          python -m pytest --cov-report xml --cov=cumulus_etl
+
+      - name: Generate coverage report
+        if: github.ref != 'refs/heads/main'
+        uses: orgoro/[email protected]
+        with:
+            coverageFile: coverage.xml
+            token: ${{ secrets.GITHUB_TOKEN }}
+            thresholdAll: .94
+            thresholdNew: 1
+            thresholdModified: 1
 
   nlp-regression:
     runs-on: ubuntu-latest
@@ -99,7 +110,7 @@ jobs:
           echo "All Good!"
 
   lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4