diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0954534..32c6d49 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,7 @@ on:
 
 permissions:
   contents: read
+  code-quality: write
 
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
@@ -123,6 +124,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -148,11 +151,27 @@ jobs:
       - name: Run JavaScript coverage
         run: npm run test:coverage
 
+      - name: Upload PHP coverage to GitHub
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/upload-code-coverage@v1
+        with:
+          report: build/coverage/phpunit/cobertura.xml
+          language: PHP
+          label: code-coverage/phpunit
+
+      - name: Upload JavaScript coverage to GitHub
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: actions/upload-code-coverage@v1
+        with:
+          report: build/coverage/jest/cobertura-coverage.xml
+          language: JavaScript
+          label: code-coverage/jest
+
       - name: Upload coverage reports
         uses: actions/upload-artifact@v4
         with:
           name: coverage-reports
           if-no-files-found: error
           path: |
-            build/logs/phpunit-clover.xml
+            build/coverage/phpunit/cobertura.xml
             build/coverage/jest
diff --git a/AGENTS.md b/AGENTS.md
index a7ca0e3..45690db 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,7 +21,8 @@ Local path: `/Volumes/SRC/JsFormValidatorBundle`
 - The JavaScript job installs Cypress system dependencies, then runs `composer update`, `npm install`, and `npm test`.
 - The PHPStan job runs on PHP `8.3`, installs dependencies with `composer update`, warms the Symfony test cache, and runs `composer phpstan`.
 - The Coverage job runs on PHP `8.3` with Xdebug and Node `22`, then runs `composer coverage` and `npm run test:coverage`.
-- Coverage thresholds currently enforced by `tools/check-clover-coverage.php`: PHP line coverage at least `50%`, JavaScript line coverage at least `60%`.
+- Coverage generates Cobertura XML, uploads it with `actions/upload-code-coverage@v1` when GitHub permissions allow, and keeps raw reports as workflow artifacts.
+- Coverage thresholds are enforced by `tools/check-coverage.php`: PHP line coverage at least `50%`, JavaScript line coverage at least `60%`.
 - The old `.travis.yml` file was removed.
 - `README.md` was updated to use a GitHub Actions badge and test instructions instead of Travis CI references.
 - `package.json` no longer advertises the old Travis CI badge in the package description.
@@ -30,7 +31,7 @@ Local path: `/Volumes/SRC/JsFormValidatorBundle`
 
 - `php /tmp/jsfv-composer.phar test` passes: `5 tests, 18 assertions`.
 - `php /tmp/jsfv-composer.phar phpstan` runs PHPStan with `phpstan.neon`.
-- `php /tmp/jsfv-composer.phar coverage` generates PHP Clover coverage and checks the `50%` line threshold.
+- `php /tmp/jsfv-composer.phar coverage` generates PHP Cobertura coverage and checks the `50%` line threshold.
 - `npm test` passes: Jest `197 tests`; Cypress e2e `16 tests`.
 - `npm run test:coverage` generates Jest coverage and checks the `60%` line threshold.
 - The local `composer` shim is broken with `Could not open input file: /Users/ton/bin/composer`, so use `/tmp/jsfv-composer.phar` locally if needed.
diff --git a/README.md b/README.md
index 97fca42..7de88de 100644
--- a/README.md
+++ b/README.md
@@ -223,5 +223,6 @@ composer validate --strict
 git diff --check
 ```
 
-The same maintained test and static-analysis checks are also run by GitHub
-Actions on pushes and pull requests.
+The same maintained test, static-analysis, and coverage checks are also run by
+GitHub Actions on pushes and pull requests. Coverage runs generate Cobertura
+reports and upload them to GitHub Code Quality when workflow permissions allow.
diff --git a/composer.json b/composer.json
index 13571b9..4b7578d 100644
--- a/composer.json
+++ b/composer.json
@@ -79,8 +79,8 @@
 
     "scripts": {
         "coverage": [
-            "XDEBUG_MODE=coverage phpunit --coverage-clover build/logs/phpunit-clover.xml --coverage-text --only-summary-for-coverage-text",
-            "php tools/check-clover-coverage.php build/logs/phpunit-clover.xml 50 PHP"
+            "XDEBUG_MODE=coverage phpunit --coverage-cobertura build/coverage/phpunit/cobertura.xml --coverage-text --only-summary-for-coverage-text",
+            "php tools/check-coverage.php build/coverage/phpunit/cobertura.xml 50 PHP"
         ],
         "phpstan": [
             "APP_ENV=test APP_DEBUG=1 php Tests/app/bin/console cache:warmup --env=test",
diff --git a/package.json b/package.json
index 2649972..f23d0b7 100755
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "scripts": {
     "test": "npm run test:unit && npm run test:e2e",
     "test:unit": "jest",
-    "test:coverage": "jest --coverage --coverageReporters=text-summary --coverageReporters=clover --coverageReporters=lcov --coverageDirectory=build/coverage/jest && php tools/check-clover-coverage.php build/coverage/jest/clover.xml 60 JavaScript",
+    "test:coverage": "jest --coverage --coverageReporters=text-summary --coverageReporters=cobertura --coverageReporters=lcov --coverageDirectory=build/coverage/jest && php tools/check-coverage.php build/coverage/jest/cobertura-coverage.xml 60 JavaScript",
     "test:e2e": "npm run test:e2e:build && start-server-and-test test:e2e:serve http://127.0.0.1:8000 test:e2e:run",
     "test:e2e:build": "php Tests/app/bin/console assets:install Tests/app/public --env=test && npm --prefix Tests/app install && npm --prefix Tests/app run build",
     "test:e2e:serve": "APP_ENV=test APP_DEBUG=1 php -S 127.0.0.1:8000 -t Tests/app/public Tests/app/public/index.php",
diff --git a/tools/check-clover-coverage.php b/tools/check-clover-coverage.php
deleted file mode 100644
index 4fe1446..0000000
--- a/tools/check-clover-coverage.php
+++ /dev/null
@@ -1,45 +0,0 @@
-<?php
-
-if (4 !== $argc) {
-    fwrite(STDERR, "Usage: php tools/check-clover-coverage.php <clover.xml> <min-percent> <label>\n");
-    exit(2);
-}
-
-$file = $argv[1];
-$minimum = (float) $argv[2];
-$label = $argv[3];
-
-if (!is_file($file)) {
-    fwrite(STDERR, sprintf("%s coverage report not found: %s\n", $label, $file));
-    exit(1);
-}
-
-$xml = simplexml_load_file($file);
-if (false === $xml || !isset($xml->project->metrics)) {
-    fwrite(STDERR, sprintf("%s coverage report is not valid Clover XML: %s\n", $label, $file));
-    exit(1);
-}
-
-$metrics = $xml->project->metrics;
-$statements = (int) $metrics['statements'];
-$coveredStatements = (int) $metrics['coveredstatements'];
-
-if (0 === $statements) {
-    fwrite(STDERR, sprintf("%s coverage report has no statements.\n", $label));
-    exit(1);
-}
-
-$coverage = $coveredStatements / $statements * 100;
-printf(
-    "%s line coverage: %.2f%% (%d/%d), minimum: %.2f%%\n",
-    $label,
-    $coverage,
-    $coveredStatements,
-    $statements,
-    $minimum
-);
-
-if ($coverage + 0.00001 < $minimum) {
-    fwrite(STDERR, sprintf("%s line coverage is below the required minimum.\n", $label));
-    exit(1);
-}
diff --git a/tools/check-coverage.php b/tools/check-coverage.php
new file mode 100644
index 0000000..9bad14b
--- /dev/null
+++ b/tools/check-coverage.php
@@ -0,0 +1,63 @@
+<?php
+
+if (4 !== $argc) {
+    fwrite(STDERR, "Usage: php tools/check-coverage.php <coverage.xml> <min-percent> <label>\n");
+    exit(2);
+}
+
+$file = $argv[1];
+$minimum = (float) $argv[2];
+$label = $argv[3];
+
+if (!is_file($file)) {
+    fwrite(STDERR, sprintf("%s coverage report not found: %s\n", $label, $file));
+    exit(1);
+}
+
+$xml = simplexml_load_file($file);
+if (false === $xml) {
+    fwrite(STDERR, sprintf("%s coverage report is not valid XML: %s\n", $label, $file));
+    exit(1);
+}
+
+[$coveredLines, $validLines, $coverage] = getCoverageMetrics($xml, $label);
+printf(
+    "%s line coverage: %.2f%% (%d/%d), minimum: %.2f%%\n",
+    $label,
+    $coverage,
+    $coveredLines,
+    $validLines,
+    $minimum
+);
+
+if ($coverage + 0.00001 < $minimum) {
+    fwrite(STDERR, sprintf("%s line coverage is below the required minimum.\n", $label));
+    exit(1);
+}
+
+/**
+ * @return array{int, int, float}
+ */
+function getCoverageMetrics(SimpleXMLElement $xml, string $label): array
+{
+    if ('coverage' !== $xml->getName()) {
+        fwrite(STDERR, sprintf("%s coverage report is not Cobertura XML.\n", $label));
+        exit(1);
+    }
+
+    $validLines = (int) $xml['lines-valid'];
+    $coveredLines = (int) $xml['lines-covered'];
+
+    if (0 === $validLines && isset($xml['line-rate'])) {
+        $coverage = (float) $xml['line-rate'] * 100;
+
+        return array(0, 0, $coverage);
+    }
+
+    if (0 === $validLines) {
+        fwrite(STDERR, sprintf("%s coverage report has no lines.\n", $label));
+        exit(1);
+    }
+
+    return array($coveredLines, $validLines, $coveredLines / $validLines * 100);
+}