diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 97d952e..09b3afb 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -60,6 +60,9 @@ jobs:
       - name: lint
         run: |
           make gofmt
+      - name : unit
+        run: |
+          make gotest
       - name: make
         run: |
           go get -v ./...
@@ -77,7 +80,12 @@ jobs:
           atomfs umount dest
           [ -f upper/zz ]
           EOF
-
+      - name: Upload code coverage
+        uses: codecov/codecov-action@v4
+        with:
+          fail_ci_if_error: true # optional (default = false)
+          files: ./coverage.txt
+          token: ${{ secrets.CODECOV_TOKEN }} # required
       - name: Release
         uses: softprops/action-gh-release@v1
         if: startsWith(github.ref, 'refs/tags/')
diff --git a/.gitignore b/.gitignore
index 1718be4..c64c6c5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,6 +15,7 @@ bin/
 /snapshot
 /.tool
 /.task
+tools/
 
 # changelog generation
 CHANGELOG.md
@@ -59,9 +60,11 @@ VERSION
 *.so
 *.dylib
 .made-gofmt
+.lint
 
 # Test binary, build with `go test -c`
 *.test
+coverage.txt
 
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
diff --git a/Makefile b/Makefile
index 8d87e45..f5c2a05 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-all: gotest atomfs
+all: lint gotest atomfs
 
 MAIN_VERSION ?= $(shell git describe --always --dirty || echo no-git)
 ifeq ($(MAIN_VERSION),$(filter $(MAIN_VERSION), "", no-git))
@@ -6,8 +6,7 @@ $(error "Bad value for MAIN_VERSION: '$(MAIN_VERSION)'")
 endif
 
 ROOT := $(shell git rev-parse --show-toplevel)
-GO_SRC_DIRS := . $(ROOT)/cmd/atomfs
-GO_SRC := $(shell find $(GO_SRC_DIRS) -name "*.go")
+GO_SRC := $(shell find . -name "*.go")
 VERSION_LDFLAGS=-X main.Version=$(MAIN_VERSION)
 
 .PHONY: gofmt
@@ -21,8 +20,9 @@ atomfs: .made-gofmt $(GO_SRC)
 	cd $(ROOT)/cmd/atomfs && go build -buildvcs=false -ldflags "$(VERSION_LDFLAGS)" -o $(ROOT)/bin/atomfs ./...
 
 gotest: $(GO_SRC)
-	go test -ldflags "$(VERSION_LDFLAGS)"  ./...
+	go test -coverprofile=coverage.txt -ldflags "$(VERSION_LDFLAGS)"  ./...
 
 clean:
-	rm -f $(ROOT)/cmd/atomfs/atomfs
+	rm -f $(ROOT)/bin
 	rm .made-*
+	rm .lint
diff --git a/molecule_test.go b/molecule_test.go
index e60ce15..758db0e 100644
--- a/molecule_test.go
+++ b/molecule_test.go
@@ -10,13 +10,14 @@ import (
 )
 
 func TestAllowMissingVerityData(t *testing.T) {
+	t.Parallel()
 	assert := assert.New(t)
 
 	// no root hash annotations on this descriptor...
 	const hash = "73cd1a9ab86defeb5e22151ceb96b347fc58b4318f64be05046c51d407a364eb"
 	d := digest.NewDigestFromEncoded(digest.Algorithm("sha256"), hash)
 	mol := Molecule{
-		Atoms: []ispec.Descriptor{ispec.Descriptor{Digest: d}},
+		Atoms: []ispec.Descriptor{{Digest: d}},
 	}
 
 	err := mol.mountUnderlyingAtoms()
diff --git a/squashfs/verity_test.go b/squashfs/verity_test.go
index ac32052..1ee55b7 100644
--- a/squashfs/verity_test.go
+++ b/squashfs/verity_test.go
@@ -45,6 +45,7 @@ var uidmapTests = []uidmapTestcase{
 }
 
 func TestAmHostRoot(t *testing.T) {
+	t.Parallel()
 	assert := assert.New(t)
 	for _, testcase := range uidmapTests {
 		v := uidmapIsHost(testcase.uidmap)