From e2c0c60218376590d2bbb8b97d8605d5eb3882f8 Mon Sep 17 00:00:00 2001
From: tjkessler <travis.j.kessler@gmail.com>
Date: Wed, 22 Jul 2026 14:01:21 -0400
Subject: [PATCH] Use Codecov OIDC via the GitHub App instead of upload tokens.

Authenticate coverage uploads with id-token permissions and use_oidc so CI
does not depend on Codecov org UI access for a repository token.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/ci.yml | 10 ++++++----
 CHANGELOG.md             |  2 ++
 CONTRIBUTING.md          |  6 +++---
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41f09c3..4c7f056 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,6 +90,10 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    # OIDC upload to Codecov via the installed GitHub App (no CODECOV_TOKEN).
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -131,11 +135,9 @@ jobs:
           files: coverage.xml
           flags: ubuntu
           name: ubuntu-py3.12
-          # Set repository secret CODECOV_TOKEN (Codecov → repo → settings).
-          # Keep false until the token exists so PRs are not blocked.
+          use_oidc: true
+          # Keep false until OIDC uploads are confirmed green.
           fail_ci_if_error: false
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   smoke:
     name: smoke (${{ matrix.os }})
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9f5bf9d..33bc02d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,8 @@ within the compatibility policy described in [API_STABILITY.md](API_STABILITY.md
 - PyPI publish workflow pins `pypa/gh-action-pypi-publish` to a full commit SHA
   (v1.14.1) and runs the test suite before uploading
 - CI uses concurrency groups and pip caching; README links live Read the Docs
+- Codecov uploads authenticate with GitHub Actions OIDC instead of
+  `CODECOV_TOKEN`
 
 ## [0.1.17] - 2026-07-22
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 6617f07..c75b74f 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -89,9 +89,9 @@ when reporting runtime failures.
 - Third-party notices for the bundled PaDEL/CDK tree are summarized in
   [NOTICE](NOTICE); full license texts remain under
   `src/padelpy/PaDEL-Descriptor/license/`.
-- Coverage uploads to Codecov from the Ubuntu Python 3.12 CI leg when the
-  repository secret `CODECOV_TOKEN` is configured (optional until Codecov org
-  access is finalized).
+- Coverage uploads to Codecov from the Ubuntu Python 3.12 CI leg via GitHub
+  Actions OIDC (`use_oidc: true`) and the Codecov GitHub App installed on
+  `ecrl` (no `CODECOV_TOKEN` required).
 
 ## Publishing releases (maintainers)