diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index bf75164..eecdee2 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -40,6 +40,37 @@ jobs:
           --features=${{ matrix.feature }} \
           //...
 
+  coverage:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: mount bazel cache
+      uses: actions/cache@v3
+      with:
+        path: "~/.cache/bazel"
+        key: bazel-coverage
+
+    - name: install libtinfo5
+      # clang tools load libtinfo5 for color diagnostics but `ubuntu-latest`
+      # runners already have `libtinfo.so.6` installed. We just create a
+      # symlink since it's faster than installing libtinfo5.
+      # https://github.com/circleci/circleci-images/issues/430#issuecomment-522602495
+      run: |
+        sudo ln -s /lib/x86_64-linux-gnu/libtinfo.so.6 /lib/x86_64-linux-gnu/libtinfo.so.5
+
+    - run: |
+        bazel \
+          --bazelrc=.github/workflows/ci.bazelrc \
+          coverage \
+          //...
+
+    - uses: codecov/codecov-action@v3
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        files: ./bazel-out/_coverage/_coverage_report.dat
+        fail_ci_if_error: true
+
   build:
     runs-on: ubuntu-latest
     strategy:
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
index 5af51c3..f9083b1 100644
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -9,3 +9,12 @@ build --remote_download_minimal
 
 test --test_output=all
 test --test_verbose_timeout_warnings
+
+coverage --combined_report=lcov
+coverage --strategy=CoverageReport=local
+coverage --experimental_split_coverage_postprocessing
+coverage --experimental_fetch_all_coverage_outputs
+coverage --remote_download_outputs=all
+coverage --experimental_remote_download_regex=.*/((testlogs/.*/_coverage/.*)|coverage.dat$|_coverage/_coverage_report.dat$)
+coverage --extra_toolchains=//toolchain:gcc
+coverage --instrumentation_filter='//.*'