From 45c340670ac5a7eddcf50779fef9035d981f92b0 Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sat, 15 Aug 2026 16:50:46 +0200 Subject: [PATCH] gh: turn on Codecov identity-token upload path The no-token upload path lets Codecov verify a run through a GitHub Actions identity token, but codecov-action only requests that token when its own opt-in input for it is enabled, and the job running the step needs the id-token permission to obtain the token in the first place. Neither was set, so the action fell back to a legacy PR-label identification method that Codecov rejects with a "Token required" error. Grant id-token: write and turn on that opt-in input on the jobs that upload coverage. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 60 +++++++++++++++++++++--------- .github/workflows/macos_tests.yaml | 10 +++-- 2 files changed, 49 insertions(+), 21 deletions(-) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index adf0625c9..a54790c5a 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -13,6 +13,8 @@ permissions: jobs: tcl86-nolibtclenvmodules: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.6 @@ -67,10 +69,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -82,6 +86,8 @@ jobs: tcl85-nolibtclenvmodules: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.5 @@ -155,10 +161,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -170,6 +178,8 @@ jobs: tcl85-2: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.5 @@ -239,10 +249,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -254,6 +266,8 @@ jobs: tcl86: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.6 @@ -308,10 +322,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -323,6 +339,8 @@ jobs: tcl85: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.5 @@ -379,10 +397,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -475,6 +495,8 @@ jobs: tcl90: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh9.0 @@ -525,10 +547,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index 02660c30c..fd1f04081 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -13,6 +13,8 @@ permissions: jobs: macos: runs-on: macos-15 + permissions: + id-token: write env: CONFIGURE_OPTS: | --prefix=/tmp/modules @@ -62,10 +64,12 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 + with: + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: