[idelsink]

Note for the team. Codecov reports This repository is deactivated for this repo, also on main with the token (main run). So Codecov stores no report until someone reactivates the repo in Codecov.
The org secret CODECOV_TOKEN will be removed (OP-3890). Then either merge this PR (and reactivate the repo in Codecov if you want coverage), or remove the Codecov upload steps. With the secret gone, the token-based upload breaks.

Why

OP-3890: the org secret CODECOV_TOKEN is not rotated. Instead, every repo uploads to Codecov with OIDC, and then the token is deleted. aignostics/peng-dev-random#255 proved that an OIDC upload works for this org. Reference PR: aignostics/pdd-mapper#89.

How

• Both Codecov upload steps in _test.yml and _scheduled-test-daily.yml use codecov/codecov-action v7.1.1 with use_oidc: true. With OIDC, the action ignores any token.
• codecov/test-results-action is archived. The test results upload is now codecov-action with report_type: test_results.
• CODECOV_TOKEN is gone from the workflow_call secrets and from the callers (ci-cd.yml, test-scheduled-{production,staging}-daily.yml).
• No permission change: the upload jobs and all their caller jobs already grant id-token: write. A called workflow cannot get more permissions than its caller gives (GitHub docs).
• actions.lock is edited by hand (the test-results-action entries are removed), because gh actions-lock rewrites every SHA pin in the repo to a tag. .github/AGENTS.md no longer lists the token.
• This repo is public. A PR from a fork gets no OIDC token. For a fork, the action uploads without a token, on the branch <fork-owner>:<branch> (action.yml). Codecov accepts this upload for a public repo (Codecov tokens).

After all repos in OP-3890 merge, the org secret CODECOV_TOKEN is deleted.

Verified

• git grep -i codecov_token and git grep test-results-action in .github return nothing.
• gh actions-lock --verify: all 21 workflows valid.
• pinact run --check on the changed files: clean.
• actionlint and zizmor (--offline --persona pedantic): the same findings as on main (same rule and file counts).
• CI/CD run: test / test passes. Both Codecov steps log Token length: 2371 (the OIDC token). The coverage step logs Found 6 coverage files to report, then Upload queued for processing complete.

Not verified

• Codecov answers This repository is deactivated to the upload and to the test results commit, after the queued ... complete line. The same message is in the log of the latest main run (token upload), so it is not caused by this change. Someone with Codecov admin rights has to reactivate the repo at https://app.codecov.io/github/aignostics/foundry-python-core/config/general. The steps stay green (fail_ci_if_error is off).
• Codecov refuses the test results commit, so the test results step stops before it searches for the JUnit files. It is not verified that report_type: test_results finds them.
• No PR from a fork ran, so the upload without a token from a fork is not tested.
• The scheduled daily tests (_scheduled-test-daily.yml) do not run on a PR. They run first on the next daily schedule after the merge.

[ox-security]

OX Security reviewed this pull request — nothing to fix.

✔ No issues found

Branch chore/OP-3890-codecov-oidc → main

View scan in OX Security →

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.