[idelsink]

Why

OP-3890: the org secret CODECOV_TOKEN is not rotated. Instead, every repo uploads to Codecov with OIDC, and then the token is deleted. aignostics/peng-dev-random#255 proved that an OIDC upload works for this org. Reference PR: aignostics/pdd-mapper#89.

How

• Both Codecov upload steps in _test.yml and _scheduled-test-daily.yml use codecov/codecov-action v7.1.1 (the latest release) with use_oidc: true. With OIDC, the action ignores any token.
• codecov/test-results-action is archived. The test results upload is now codecov-action with report_type: test_results.
• CODECOV_TOKEN is gone from the workflow_call secrets and from the callers (ci-cd.yml, scheduled-testing-{production,staging}-daily.yml).
• OIDC needs id-token: write. These jobs had contents: read only, since d0eee9f. The permission is added on the test job in _test.yml, the job in _scheduled-test-daily.yml, and the three caller jobs. Each line has a comment, for zizmor undocumented-permissions. A called workflow cannot get more permissions than its caller gives (GitHub docs).
• actions.lock is edited by hand (the test-results-action entries are removed), because gh actions-lock rewrites every SHA pin in the repo to a tag. .github/CLAUDE.md and the CI/CD spec no longer list the token.
• This repo is public. On a PR from a fork, the action detects the fork, skips OIDC and uploads without a token. A fork PR did not get CODECOV_TOKEN before either. Codecov accepts a tokenless upload from a fork of a public repo (Codecov tokens). The step if: conditions are unchanged.

After all repos in OP-3890 merge, the org secret CODECOV_TOKEN is deleted.

Verified

• git grep -i codecov_token returns nothing. git grep test-results-action finds only two old release notes in CHANGELOG.md.
• gh actions-lock --verify: all 28 workflows valid.
• actionlint and zizmor 1.32.0 (--offline --persona pedantic): the same count per rule as on main.
• pinact run --check exits 1 for the # v5.2 comment of pyvista/setup-headless-display-action in _claude-code.yml, _scheduled-test-daily.yml and _test.yml. The same on main; not touched here.
• CI/CD run, job test / test (ubuntu-latest, false): both Codecov steps pass. Each logs Token length: 2323 (the OIDC token) and Upload queued for processing complete (coverage: 13 files; test results: 8 test_results files). Only the ubuntu leg uploads.

Not verified

• The macos-15-intel leg of test / test still runs. The other experimental legs passed. These legs do not upload to Codecov.
• _scheduled-test-daily.yml and its callers scheduled-testing-{production,staging}-daily.yml do not run on a PR. They run first on the next daily schedule after the merge.
• No PR from a fork ran with this change.

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/OP-3890-codecov-oidc → main

View scan in OX Security →

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud