From 34dcfea4f247d2e2cd37446adea3bbe27429f40b Mon Sep 17 00:00:00 2001 From: Johannes Maron Date: Sat, 10 Oct 2026 23:24:51 +0200 Subject: [PATCH] Use Codecov OIDC authentication * Add use_oidc to every codecov step * Grant id-token: write to the upload jobs * Drop the CODECOV_TOKEN secret --- .github/workflows/ci.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7b4b10d..4f5b8f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,6 +16,9 @@ jobs: with: path: dist/* PyTest: + permissions: + contents: read + id-token: write runs-on: ubuntu-latest strategy: matrix: @@ -29,7 +32,12 @@ jobs: - run: uv run relint --version - run: uv run --group test py.test --cov=. - uses: codecov/codecov-action@v7 + with: + use_oidc: true extras: + permissions: + contents: read + id-token: write runs-on: ubuntu-latest strategy: matrix: @@ -41,6 +49,8 @@ jobs: - run: uv run relint --version - run: uv run --group test --extra ${{ matrix.extras }} py.test --cov=. - uses: codecov/codecov-action@v7 + with: + use_oidc: true analyze: name: CodeQL Analyze needs: [PyTest, extras]