ci(codecov): upload with OIDC instead of CODECOV_TOKEN

.github/CLAUDE.md

@@ -133,7 +133,7 @@ Output: `aignostics.7z` per platform. Local: `make dist_native`.
 E2E. **Production** (`platform.aignostics.com`) is used only by scheduled jobs
 and release validation — never in PR CI.
 
-GitHub secrets: `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`, `CODECOV_TOKEN`,
+GitHub secrets: `AIGNOSTICS_REFRESH_TOKEN_{STAGING,PRODUCTION}`,
 `SONAR_TOKEN`, `UV_PUBLISH_TOKEN`, `KETRYX_API_KEY`.
 
 GitHub variables: `KETRYX_PROJECT`.

.github/workflows/_scheduled-test-daily.yml

@@ -13,8 +13,6 @@ on:
         required: true
       AIGNOSTICS_REFRESH_TOKEN_PRODUCTION:
         required: true
-      CODECOV_TOKEN:
-        required: true
       SONAR_TOKEN:
         required: true
 
@@ -29,6 +27,7 @@ jobs:
     runs-on: "ubuntu-latest"
     permissions:
       contents: read
+      id-token: write # Codecov OIDC upload
     steps:
 
       - name: Checkout
@@ -220,14 +219,15 @@ jobs:
         uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT')}}
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           slug: aignostics/python-sdk
 
       - name: Upload test results to Codecov
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}
-        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
+          report_type: test_results
 
       - name: SonarQube Scan
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') }}

.github/workflows/_test.yml

@@ -17,8 +17,6 @@ on:
         required: false
       AIGNOSTICS_REFRESH_TOKEN_PRODUCTION:
         required: false
-      CODECOV_TOKEN:
-        required: false
       SONAR_TOKEN:
         required: false
 
@@ -56,6 +54,7 @@ jobs:
       matrix: ${{ fromJSON(needs.generate-matrix.outputs.matrix) }}
     permissions:
       contents: read
+      id-token: write # Codecov OIDC upload
     steps:
 
       - name: Checkout
@@ -221,7 +220,7 @@ jobs:
           !contains(inputs.commit_message, 'skip:codecov') &&
           !contains(github.event.pull_request.labels.*.name, 'skip:codecov')
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           slug: aignostics/python-sdk
 
       - name: Upload test results to Codecov
@@ -231,9 +230,10 @@ jobs:
           matrix.runner == 'ubuntu-latest' &&
           !contains(inputs.commit_message, 'skip:codecov') &&
           !contains(github.event.pull_request.labels.*.name, 'skip:codecov')
-        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
+          report_type: test_results
 
       - name: SonarQube Scan
         if: ${{ !cancelled() && (env.GITHUB_WORKFLOW_RUNTIME != 'ACT') && matrix.runner == 'ubuntu-latest' }}

.github/workflows/actions.lock

@@ -39,7 +39,6 @@ workflows:
         - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         - 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884'
         - 'codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5'
-        - 'codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3'
         - 'pyvista/setup-headless-display-action@10e6efb97af3cd1523828f0e22c39f0e4567f3e4'
         - 'sonarsource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
         - 'spicypizza/create-envfile@ace6d4f5d7802b600276c23ca417e669f1a06f6f'
@@ -57,7 +56,6 @@ workflows:
         - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         - 'astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884'
         - 'codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5'
-        - 'codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3'
         - 'pyvista/setup-headless-display-action@10e6efb97af3cd1523828f0e22c39f0e4567f3e4'
         - 'sonarsource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9'
         - 'spicypizza/create-envfile@ace6d4f5d7802b600276c23ca417e669f1a06f6f'
@@ -123,11 +121,6 @@ dependencies:
         repo_id: 200299178
         uses:
             - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
-    'codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3':
-        ref: 'v1.2.1'
-        commit: 'sha1-0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3'
-        owner_id: 8226205
-        repo_id: 761956558
     'crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d':
         ref: 'v6.0.0'
         commit: 'sha1-548a7c3603594ec17c819e1239f281a3b801ab4d'

.github/workflows/ci-cd.yml

@@ -126,11 +126,11 @@ jobs:
       commit_message: ${{ needs.get-commit-message.outputs.commit_message }}
     permissions:
       contents: read
+      id-token: write # Codecov OIDC upload
     secrets:
       AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }}
       AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }}
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   codeql:
     needs: [get-commit-message]

.github/workflows/scheduled-testing-production-daily.yml

@@ -19,8 +19,8 @@ jobs:
       platform_environment: "production"
     permissions:
       contents: read
+      id-token: write # Codecov OIDC upload
     secrets:
       AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }}
       AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.github/workflows/scheduled-testing-staging-daily.yml

@@ -19,8 +19,8 @@ jobs:
       platform_environment: "staging"
     permissions:
       contents: read
+      id-token: write # Codecov OIDC upload
     secrets:
       AIGNOSTICS_REFRESH_TOKEN_STAGING: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_STAGING }}
       AIGNOSTICS_REFRESH_TOKEN_PRODUCTION: ${{ secrets.AIGNOSTICS_REFRESH_TOKEN_PRODUCTION }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

specifications/SPEC-BUILD-CHAIN-CICD-SERVICE.md

@@ -320,7 +320,6 @@ uv run nox -s dist    # Package building
 | ----------------------------- | ------------------------------ | --------------------- |
 | `GITHUB_TOKEN`                | GitHub API authentication      | `ghp_xxxxxxxxxxxx`    |
 | `UV_PUBLISH_TOKEN`            | PyPI publishing authentication | `pypi-xxxxxxx`        |
-| `CODECOV_TOKEN`               | Coverage reporting             | `xxxxxxxx-xxxx-xxxx`  |
 | `SONAR_TOKEN`                 | SonarQube authentication       | `squ_xxxxxxxx`        |
 | `AIGNOSTICS_CLIENT_ID_DEVICE` | Platform API testing           | `client_id_value`     |
 | `AIGNOSTICS_REFRESH_TOKEN`    | Platform API testing           | `refresh_token_value` |