Restore codecov as a separate workflow

.github/workflows/coverage.yml

@@ -0,0 +1,61 @@
+name: coverage
+
+permissions:
+  contents: read
+
+on:
+  # We run coverage on main so that PRs can have a meaninful comparison that
+  # doesn't lag a whole day.
+  push:
+    branches:
+      - main
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_RETRY: 10
+  RUSTFLAGS: "-D warnings -A deprecated -C debuginfo=2"
+  RUSTUP_MAX_RETRIES: 10
+
+concurrency:
+  group:  ${{ github.workflow }}-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  meta:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    steps:
+      - id: changed
+        uses: tj-actions/changed-files@800a2825992141ddde1a8bca8ad394cec34d3188
+        with:
+          files: |
+            .codecov.yml
+            .github/workflows/coverage.yml
+            **/*.rs
+          ignore_files: |
+            *-proto/**
+    outputs:
+      any_changed: ${{ steps.changed.outputs.any_changed }}
+
+  codecov:
+    needs: meta
+    if: github.event_name === 'push' || needs.meta.outputs.any_changed
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    container:
+      image: docker://ghcr.io/linkerd/dev:v43-rust
+      options: --security-opt seccomp=unconfined # 🤷
+    env:
+      CXX: "/usr/bin/clang++-14"
+    steps:
+      # XXX(ver) Workaround for a linking problem in the binary we store in the
+      # devcontainer.
+      - run: scurl https://github.com/xd009642/tarpaulin/releases/download/0.27.1/cargo-tarpaulin-x86_64-unknown-linux-musl.tar.gz | tar -C /usr/local/bin -zxvf -
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
+      # linkerd-transport-header and opencencus-proto tests only check codegen.
+      - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --no-run
+      - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --skip-clean --ignore-tests --no-fail-fast --out=Xml
+        # Some tests are especially flakey in coverage tests. That's fine. We
+        # only really care to measure how much of our codebase is covered.
+        continue-on-error: true
+      - uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab

.github/workflows/pr.yml

@@ -79,29 +79,6 @@ jobs:
       - run: just fetch
       - run: just check-crate ${{ matrix.crate }}
 
-  rust-coverage:
-    needs: meta
-    if: needs.meta.outputs.rust_changed
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    container:
-      image: docker://ghcr.io/linkerd/dev:v43-rust
-      options: --security-opt seccomp=unconfined # 🤷
-    env:
-      CXX: "/usr/bin/clang++-14"
-    steps:
-      # XXX(ver) Workaround for a linking problem in the binary we store in the
-      # devcontainer.
-      # - run: scurl https://github.com/xd009642/tarpaulin/releases/download/0.27.1/cargo-tarpaulin-x86_64-unknown-linux-musl.tar.gz | tar -C /usr/local/bin -zxvf -
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      # linkerd-transport-header and opencencus-proto tests only check codegen.
-      - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --exclude=spire-proto --no-run
-      - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --exclude=spire-proto --skip-clean --ignore-tests --no-fail-fast --out=Xml
-        # Some tests are especially flakey in coverage tests. That's fine. We
-        # only really care to measure how much of our codebase is covered.
-        continue-on-error: true
-      - uses: codecov/codecov-action@54bcd8715eee62d40e33596ef5e8f0f48dbbccab
-
   linkerd-install:
     needs: meta
     if: needs.meta.outputs.any_changed