The Upload to Codecov step in ci.yml passes token: ${{ secrets.CODECOV_TOKEN }}. alunduil-chezmoi uploads with use_oidc: true instead, which leaves no upload token to store, rotate, or leak, and alunduil/zfs-replicate#687 adopts the same. Converging the rest gives the repositories one Codecov pattern.
Additional context
- Reference: the
shell-tests job in alunduil-chezmoi's ci.yml.
- A fork's pull request gets a read-only
GITHUB_TOKEN, so id-token: write is unavailable there and the upload fails. Secrets are withheld from fork pull requests too, so the token this replaces fails the same way; worth confirming rather than assuming when the change lands.
- The secret itself lives wherever
alunduil-infrastructure manages this repository, so the last item is a change there, not here.
The
Upload to Codecovstep inci.ymlpassestoken: ${{ secrets.CODECOV_TOKEN }}.alunduil-chezmoiuploads withuse_oidc: trueinstead, which leaves no upload token to store, rotate, or leak, andalunduil/zfs-replicate#687adopts the same. Converging the rest gives the repositories one Codecov pattern.id-token: writeto the coverage job'spermissionsblock, alongside thecontents: readit already needs for checkout.token:input withuse_oidc: true.CODECOV_TOKENsecret once no workflow reads it.Additional context
shell-testsjob inalunduil-chezmoi'sci.yml.GITHUB_TOKEN, soid-token: writeis unavailable there and the upload fails. Secrets are withheld from fork pull requests too, so the token this replaces fails the same way; worth confirming rather than assuming when the change lands.alunduil-infrastructuremanages this repository, so the last item is a change there, not here.