From 18958e4c02874a5c9eddece3afb448ea774fc5ec Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 5 Nov 2026 10:20:51 +0100 Subject: [PATCH] ci: use OIDC authentication for Codecov uploads Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication. Codecov supports tokenless uploads for public repositories, but authenticated uploads are still needed to protect coverage results on protected branches from unauthorized uploads. Grant `id-token: write` at the job level to allow Codecov to request a short-lived OIDC token. This permission does not grant repository write access, and scoping it to the job avoids granting it to other jobs added to the workflow in the future. Coverage uploads from forked pull requests continue to use Codecov's tokenless upload mechanism. See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc Signed-off-by: Sebastiaan van Stijn --- .github/workflows/e2e.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 5773ef4bc7..bfcab76b02 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -26,6 +26,9 @@ on: jobs: tests: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc runs-on: ubuntu-26.04 strategy: fail-fast: false @@ -80,4 +83,4 @@ jobs: uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 with: files: ./build/coverage/coverage.txt - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true