diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml
index c9e90afa..625484a2 100644
--- a/.github/workflows/php.yml
+++ b/.github/workflows/php.yml
@@ -20,6 +20,8 @@ env:
   PHP_VERSION_LATEST: "8.2"
   PHP_PROJECT_EXT: dom,json,libxml  # via `composer info -pt`
   REPORTS_DIR: CI_reports
+  TESTS_REPORTS_ARTIFACT: tests-reports
+  TYPES_REPORTS_ARTIFACT: types-reports
 
 jobs:
   composer-validate:
@@ -43,8 +45,6 @@ jobs:
   phpunit:
     name: PHPUnit (${{ matrix.os}}, ${{ matrix.php }}, ${{ matrix.dependencies }})
     runs-on: ${{ matrix.os }}
-    env:
-      REPORTS_ARTIFACT: tests-reports
     strategy:
       fail-fast: false
       matrix:
@@ -117,22 +117,41 @@ jobs:
           -d memory_limit=-1
           tools/phpunit/vendor/phpunit/phpunit/phpunit
           --no-progress
-          --log-junit=${{ env.REPORTS_DIR }}/tests.${{ matrix.os }}_php${{ matrix.php }}_${{ matrix.dependencies }}.junit.xml
-          --coverage-clover=${{ env.REPORTS_DIR }}/coverage.${{ matrix.os}}_php${{ matrix.php }}_${{ matrix.dependencies }}.clover.xml
+          --log-junit='${{ env.REPORTS_DIR }}/tests/${{ matrix.os }}_php${{ matrix.php }}_${{ matrix.dependencies }}.junit.xml'
+          --coverage-clover='${{ env.REPORTS_DIR }}/coverage/${{ matrix.os }}_php${{ matrix.php }}_${{ matrix.dependencies }}.clover.xml'
       - name: Artifact reports
         if: ${{ ! cancelled() }}
         # see https://github.com/actions/upload-artifact
         uses: actions/upload-artifact@v3
         with:
-          name: ${{ env.REPORTS_ARTIFACT }}
+          name: ${{ env.TESTS_REPORTS_ARTIFACT }}
           path: ${{ env.REPORTS_DIR }}
           if-no-files-found: error
+  report-coverage:
+    name: Publish test coverage
+    needs: [ "phpunit" ]
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: fetch test artifacts
+        # see https://github.com/actions/download-artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: ${{ env.TESTS_REPORTS_ARTIFACT }}
+          path: ${{ env.REPORTS_DIR }}
+      - name: Run codacy-coverage-reporter
+        env:
+          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
+        if: ${{ env.CODACY_PROJECT_TOKEN != '' }} ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
+        # see https://github.com/codacy/codacy-coverage-reporter-action
+        uses: codacy/codacy-coverage-reporter-action@v1
+        with:
+          project-token: ${{ env.CODACY_PROJECT_TOKEN }}
+          coverage-reports: ${{ env.REPORTS_DIR }}/coverage/*.clover.xml
   code-checker:
     name: Code Analysis p${{ matrix.php }} c${{ matrix.composer }} ${{ matrix.dependencies }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    env:
-      REPORTS_ARTIFACT: types-reports
     strategy:
       fail-fast: false
       matrix:
@@ -198,14 +217,14 @@ jobs:
           --no-cache
           --long-progress
           --php-version='${{ matrix.php }}'
-          --report='${{ env.REPORTS_DIR }}/psalm.php${{ matrix.php }}_${{ matrix.dependencies }}.junit.xml'
+          --report='${{ env.REPORTS_DIR }}/psalm/php${{ matrix.php }}_${{ matrix.dependencies }}.junit.xml'
           --stats
       - name: Artifact reports
         if: ${{ ! cancelled() }}
         # see https://github.com/actions/upload-artifact
         uses: actions/upload-artifact@v3
         with:
-          name: ${{ env.REPORTS_ARTIFACT }}
+          name: ${{ env.TYPES_REPORTS_ARTIFACT }}
           path: ${{ env.REPORTS_DIR }}
           if-no-files-found: error
   composer-unused:
@@ -364,3 +383,4 @@ jobs:
           --no-update-lock
           --no-interaction
           $PWD/composer.json
+
diff --git a/README.md b/README.md
index da2ebb30..83e9995c 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
 
 [![shield_packagist-version]][link_packagist]
 [![shield_gh-workflow-test]][link_gh-workflow-test]
+[![shield_coverage]][link_codacy]
 [![shield_ossf-best-practices]][link_ossf-best-practices]
 [![shield_license]][license_file]  
 [![shield_website]][link_website]
@@ -121,6 +122,7 @@ See the [LICENSE][license_file] file for the full license.
 
 [shield_gh-workflow-test]: https://img.shields.io/github/actions/workflow/status/CycloneDX/cyclonedx-php-composer/php.yml?branch=master&logo=GitHub&logoColor=white "build"
 [shield_packagist-version]: https://img.shields.io/packagist/v/cyclonedx/cyclonedx-php-composer?logo=Packagist&logoColor=white "packagist"
+[shield_coverage]: https://img.shields.io/codacy/coverage/30d812e89a8e429695ba1e4fc7969958?logo=Codacy&logoColor=white "test coverage"
 [shield_ossf-best-practices]: https://img.shields.io/cii/level/7953?label=OpenSSF%20best%20practices "OpenSSF best practices"
 [shield_license]: https://img.shields.io/github/license/CycloneDX/cyclonedx-php-composer?logo=open%20source%20initiative&logoColor=white "license"
 [shield_website]: https://img.shields.io/badge/https://-cyclonedx.org-blue.svg "homepage"
@@ -128,6 +130,7 @@ See the [LICENSE][license_file] file for the full license.
 [shield_groups]: https://img.shields.io/badge/discussion-groups.io-blue.svg "groups discussion"
 [shield_twitter-follow]: https://img.shields.io/badge/Twitter-follow-blue?logo=Twitter&logoColor=white "twitter follow"
 [link_gh-workflow-test]: https://github.com/CycloneDX/cyclonedx-php-composer/actions/workflows/php.yml?query=branch%3Amaster
+[link_codacy]: https://app.codacy.com/gh/CycloneDX/cyclonedx-php-composer
 [link_ossf-best-practices]: https://www.bestpractices.dev/projects/7953
 [link_packagist]: https://packagist.org/packages/cyclonedx/cyclonedx-php-composer
 [link_website]: https://cyclonedx.org/