Sebastiaan van Stijn
b43eb80ada
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication. Codecov supports tokenless uploads for public repositories, but authenticated uploads are still needed to protect coverage results on protected branches from unauthorized uploads. Grant `id-token: write` at the job level to allow Codecov to request a short-lived OIDC token. This permission does not grant repository write access, and scoping it to the job avoids granting it to other jobs added to the workflow in the future. Coverage uploads from forked pull requests continue to use Codecov's tokenless upload mechanism. See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc Signed-off-by: Sebastiaan van Stijn <github@gone.nl>