diff --git a/.github/codecov-upstream.yml b/.github/codecov-upstream.yml
new file mode 100644
index 000000000..1256a4389
--- /dev/null
+++ b/.github/codecov-upstream.yml
@@ -0,0 +1,13 @@
+# this file replaces <root>/codecov.yml when building on the main repository and PRs
+coverage:
+  status:
+    project: true
+    patch: true
+    changes: true
+
+comment: off
+
+codecov:
+  # token from: https://codecov.io/gh/pytest-dev/pytest/settings
+  # use same URL to regenerate it if needed
+  token: "1eca3b1f-31a2-4fb8-a8c3-138b441b50a7"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index f3a2bccfc..5d7493e72 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,8 +1,7 @@
-# evaluating GitHub actions for CI, disconsider failures when evaluating PRs
+# evaluating GitHub actions for CI, disregard failures when evaluating PRs
 #
 # this is still missing:
 # - deploy
-# - coverage
 # - upload github notes
 #
 name: main
@@ -17,7 +16,6 @@ on:
 
 jobs:
   build:
-
     runs-on: ${{ matrix.os }}
 
     strategy:
@@ -86,6 +84,8 @@ jobs:
             python: "3.7"
             os: ubuntu-latest
             tox_env: "py37-freeze"
+            # coverage does not apply for freeze test, skip it
+            skip_coverage: true
           - name: "ubuntu-py38"
             python: "3.8"
             os: ubuntu-latest
@@ -94,6 +94,8 @@ jobs:
             python: "pypy3"
             os: ubuntu-latest
             tox_env: "pypy3-xdist"
+            # coverage too slow with pypy3, skip it
+            skip_coverage: true
 
           - name: "macos-py37"
             python: "3.7"
@@ -118,6 +120,37 @@ jobs:
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip
-        pip install tox
-    - name: Test
-      run: tox -e ${{ matrix.tox_env }}
+        pip install tox coverage
+
+    - name: Test without coverage
+      if: "matrix.skip_coverage"
+      run: "tox -e ${{ matrix.tox_env }}"
+
+    - name: Test with coverage
+      if: "! matrix.skip_coverage"
+      env:
+        _PYTEST_TOX_COVERAGE_RUN: "coverage run -m"
+        COVERAGE_PROCESS_START: ".coveragerc"
+        _PYTEST_TOX_EXTRA_DEP: "coverage-enable-subprocess"
+      run: "tox -e ${{ matrix.tox_env }}"
+
+    - name: Prepare coverage token
+      if: success() && !matrix.skip_coverage && ( github.repository == 'pytest-dev/pytest' || github.event_name == 'pull_request' )
+      run: |
+        cp .github/codecov-upstream.yml codecov.yml
+
+    - name: Combine coverage
+      if: success() && !matrix.skip_coverage
+      run: |
+        python -m coverage combine
+        python -m coverage xml
+
+    - name: Codecov upload
+      if: success() && !matrix.skip_coverage
+      uses: codecov/codecov-action@v1
+      with:
+        token: ${{ secrets.codecov }}
+        file: ./coverage.xml
+        flags: ${{ runner.os }}
+        fail_ci_if_error: false
+        name: ${{ matrix.name }}
diff --git a/codecov.yml b/codecov.yml
index a0a308588..44fd14710 100644
--- a/codecov.yml
+++ b/codecov.yml
@@ -1,3 +1,5 @@
+# note: `.github/codecov-upstream.yml` is basically a copy of this file, please propagate
+# changes as needed
 coverage:
   status:
     project: true
diff --git a/tox.ini b/tox.ini
index d33a62224..8fc69e89d 100644
--- a/tox.ini
+++ b/tox.ini
@@ -26,7 +26,7 @@ passenv = USER USERNAME COVERAGE_* TRAVIS PYTEST_ADDOPTS TERM
 setenv =
     _PYTEST_TOX_DEFAULT_POSARGS={env:_PYTEST_TOX_POSARGS_LSOF:} {env:_PYTEST_TOX_POSARGS_XDIST:}
 
-    # Configuration to run with coverage similar to Travis/Appveyor, e.g.
+    # Configuration to run with coverage similar to CI, e.g.
     # "tox -e py37-coverage".
     coverage: _PYTEST_TOX_COVERAGE_RUN=coverage run -m
     coverage: _PYTEST_TOX_EXTRA_DEP=coverage-enable-subprocess