diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index fad852a0..ccd2877c 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -90,6 +90,23 @@ jobs:
                           scons -j$(nproc) ${{ matrix.flags }} && \
                           tests/safety/test.sh"
 
+  safety_coverage:
+    name: safety coverage
+    runs-on: ubuntu-20.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v2
+      - name: Build Docker image
+        run: eval "$BUILD"
+      - name: Run safety coverage test
+        timeout-minutes: 5
+        run: |
+          ${{ env.RUN }} "cd .. && \
+                          scons -c && \
+                          scons -j$(nproc) opendbc/ cereal/ && \
+                          cd panda/tests/safety && \
+                          ./test_coverage.sh"
+
   misra:
     name: misra c2012
     runs-on: ubuntu-20.04
diff --git a/tests/safety/test_coverage.sh b/tests/safety/test_coverage.sh
index 469b9e16..c5168004 100755
--- a/tests/safety/test_coverage.sh
+++ b/tests/safety/test_coverage.sh
@@ -2,12 +2,26 @@
 set -e
 
 # reset coverage data and generate gcc note file
+rm -f ../libpanda/*.gcda
 scons -j$(nproc) -D --coverage
 
 # run safety tests to generate coverage data
 ./test.sh
 
 # generate and open report
-geninfo ../libpanda/ -o coverage.info
-genhtml coverage.info -o coverage-out
-browse coverage-out/index.html
+if [ "$1" == "--report" ]; then
+  geninfo ../libpanda/ -o coverage.info
+  genhtml coverage.info -o coverage-out
+  browse coverage-out/index.html
+fi
+
+# test coverage
+GCOV_OUTPUT=$(gcov -n ../libpanda/panda.c)
+INCOMPLETE_COVERAGE=$(echo "$GCOV_OUTPUT" | paste -s -d' \n' | grep "File.*safety/safety_.*.h" | grep -v "100.00%" || true)
+if [ -n "$INCOMPLETE_COVERAGE" ]; then
+  echo "FAILED: Some files have less than 100% coverage:"
+  echo "$INCOMPLETE_COVERAGE"
+  exit 1
+else
+  echo "SUCCESS: All checked files have 100% coverage!"
+fi