diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
index ee9a5ed6..b79e717f 100644
--- a/.github/workflows/tox.yml
+++ b/.github/workflows/tox.yml
@@ -34,6 +34,7 @@ jobs:
 
   tox:
     name: ${{ matrix.name }} / python ${{ matrix.python_version }}
+    environment: test
     runs-on: ubuntu-20.04
     needs: pre
     strategy:
@@ -63,11 +64,47 @@ jobs:
         continue-on-error: ${{ matrix.devel || false }}
         run: python3 -m tox -e ${{ matrix.passed_name }}
 
+      - name: Archive logs
+        uses: actions/upload-artifact@v4
+        with:
+          name: logs-${{ matrix.name }}.zip
+          path: .tox/**/log/
+
+      - name: Upload coverage data
+        if: ${{ startsWith(matrix.name, 'py') }}
+        uses: codecov/codecov-action@v4
+        with:
+          name: ${{ matrix.name }}
+          token: ${{ secrets.CODECOV_TOKEN }}
+          verbose: true
+          fail_ci_if_error: true
+
+      - name: Report failure if git reports dirty status
+        run: |
+          if [[ -n $(git status -s) ]]; then
+            # shellcheck disable=SC2016
+            echo -n '::error file=git-status::'
+            printf '### Failed as git reported modified and/or untracked files\n```\n%s\n```\n' "$(git status -s)" | tee -a "$GITHUB_STEP_SUMMARY"
+            exit 99
+          fi
+        # https://github.com/actions/toolkit/issues/193
   tox_passed:
+    if: always()
+
     needs: tox
     runs-on: ubuntu-latest
     steps:
-      - run: >-
-          python -c "assert set([
-          '${{ needs.tox.result }}',
-          ]) == {'success'}"
+      - name: Merge logs into a single archive
+        uses: actions/upload-artifact/merge@v4
+        with:
+          name: logs.zip
+          pattern: logs*.zip
+          delete-merged: true
+
+      - name: Check codecov.io status
+        uses: coactions/codecov-status@main
+
+      - name: Decide whether the needed jobs succeeded or failed
+        uses: re-actors/alls-green@release/v1
+        with:
+          jobs: ${{ toJSON(needs) }}
diff --git a/README.md b/README.md
index 89ac6825..d855d6ed 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ ansible-dev-tools                        0.2.0a0
 ansible-lint                             24.2.0
 ansible-navigator                        24.2.0
 ansible-sign                             0.1.1
-molecule                                 6.0.3
+molecule                                 24.2.0
 pytest-ansible                           24.1.2
 tox-ansible                              24.2.0
 ```
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 00000000..71b3b4d1
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,4 @@
+comment: false
+coverage:
+  status:
+    patch: true # we want github annotations
diff --git a/tox.ini b/tox.ini
index 0937eec6..98823339 100644
--- a/tox.ini
+++ b/tox.ini
@@ -32,8 +32,9 @@ set_env =
     PRE_COMMIT_COLOR = always
     TERM = xterm-256color
 commands =
-    coverage run --debug=trace -m pytest {posargs}
-    sh -c "coverage combine -q .tox/.coverage.* && coverage xml || true && coverage report"
+    coverage run -m pytest {posargs}
+    coverage xml
+    coverage report
     git diff --exit-code
 allowlist_externals =
     bash
@@ -75,12 +76,14 @@ description = Builds docs
 skip_install = true
 set_env =
     NO_COLOR = 1
+    PIP_CONSTRAINT = {toxinidir}/.config/constraints.txt
     TERM = dump
 commands =
     bash -c "SETUPTOOLS_SCM_PRETEND_VERSION=$(git describe --tags --abbrev=0) pip install -q -e '.[docs]'"
     adt --version
     python3 tools/update-readme.py
     mkdocs {posargs:build --strict --site-dir=_readthedocs/html/}
+    git diff --exit-code
 
 [testenv:deps]
 description = Bump all test dependencies
@@ -106,13 +109,3 @@ deps =
 extras =
 commands =
     coverage erase
-
-[testenv:report]
-description = Produce coverage report
-skip_install = true
-deps =
-    coverage[toml]
-extras =
-commands =
-    coverage report
-    cat .tox/.tmp/.mypy/index.txt