Authenticate Codecov uploads with GitHub OIDC

.github/workflows/ci.yml

@@ -90,6 +90,10 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    # OIDC upload to Codecov via the installed GitHub App (no CODECOV_TOKEN).
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -131,11 +135,9 @@ jobs:
           files: coverage.xml
           flags: ubuntu
           name: ubuntu-py3.12
-          # Set repository secret CODECOV_TOKEN (Codecov → repo → settings).
-          # Keep false until the token exists so PRs are not blocked.
+          use_oidc: true
+          # Keep false until OIDC uploads are confirmed green.
           fail_ci_if_error: false
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   smoke:
     name: smoke (${{ matrix.os }})

CHANGELOG.md

@@ -27,6 +27,8 @@ within the compatibility policy described in [API_STABILITY.md](API_STABILITY.md
 - PyPI publish workflow pins `pypa/gh-action-pypi-publish` to a full commit SHA
   (v1.14.1) and runs the test suite before uploading
 - CI uses concurrency groups and pip caching; README links live Read the Docs
+- Codecov uploads authenticate with GitHub Actions OIDC instead of
+  `CODECOV_TOKEN`
 
 ## [0.1.17] - 2026-07-22
 

CONTRIBUTING.md

@@ -89,9 +89,9 @@ when reporting runtime failures.
 - Third-party notices for the bundled PaDEL/CDK tree are summarized in
   [NOTICE](NOTICE); full license texts remain under
   `src/padelpy/PaDEL-Descriptor/license/`.
-- Coverage uploads to Codecov from the Ubuntu Python 3.12 CI leg when the
-  repository secret `CODECOV_TOKEN` is configured (optional until Codecov org
-  access is finalized).
+- Coverage uploads to Codecov from the Ubuntu Python 3.12 CI leg via GitHub
+  Actions OIDC (`use_oidc: true`) and the Codecov GitHub App installed on
+  `ecrl` (no `CODECOV_TOKEN` required).
 
 ## Publishing releases (maintainers)