[libc] [llvm] [libc][ci] Add automated pre-commit and post-commit coverage bots (PR #215269)

[via llvm-commits]

================
@@ -0,0 +1,134 @@
+name: libc post-commit code coverage
+
+permissions:
+  contents: write # Required to publish live HTML dashboard to gh-pages branch
+
+on:
+  # Daily overnight run at 02:00 UTC
+  schedule:
+    - cron: '0 2 * * *'
+
+  # Allow manual on-demand execution from GitHub Actions UI
+  workflow_dispatch:
+
+  # Trigger on pushes to main / post-commit-bot
+  push:
+    branches:
+      - main
+      - post-commit-bot
+    paths:
+      - 'libc/**'
+      - '.github/workflows/libc-post-commit-coverage.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  full-coverage:
+    timeout-minutes: 60
+    name: libc-full-coverage
+    runs-on: ubuntu-24.04
+    container:
+      image: ghcr.io/llvm/libc-ubuntu-24.04:latest at sha256:8fee4c9ce5a1fd095686593cd36e032c48a31b6ae575378c82accd1d86a08d59
+      options: --privileged
+    defaults:
+      run:
+        shell: bash
+    steps:
+    - name: Checkout Code
+      uses: actions/checkout at v4
+      with:
+        fetch-depth: 1
+        persist-credentials: false
+
+    - name: Setup Compiler Cache (sccache)
+      uses: hendrikmuhs/ccache-action at v1.2.23
----------------
github-advanced-security[bot] wrote:

## CodeQL / Unpinned tag for a non-immutable Action in workflow or composite action

Unpinned 3rd party Action 'libc post-commit code coverage' step [Uses Step](1) uses 'hendrikmuhs/ccache-action' with ref 'v1.2.23', not a pinned commit hash

[Show more details](https://github.com/llvm/llvm-project/security/code-scanning/2299)

https://github.com/llvm/llvm-project/pull/215269