🚸 improve coverage data collection

.github/workflows/reusable-cpp-ci.yml

@@ -1,10 +1,6 @@
 name: 🇨‌ • CI
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       cmake-args:
         description: "Additional arguments to pass to CMake on every OS"
@@ -69,8 +65,6 @@ jobs:
   coverage:
     name: 📈
     uses: ./.github/workflows/reusable-cpp-coverage.yml
-    secrets:
-      token: ${{ secrets.token }}
     with:
       cmake-args: ${{ inputs.cmake-args }} ${{ inputs.cmake-args-ubuntu }}
       setup-z3: ${{ inputs.setup-z3 }}

.github/workflows/reusable-cpp-coverage.yml

@@ -1,10 +1,6 @@
 name: 🇨 • Coverage
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       cmake-args:
         description: "Additional arguments to pass to CMake"
@@ -23,6 +19,8 @@ jobs:
   coverage:
     name: 📈 Coverage
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     env:
       CMAKE_BUILD_PARALLEL_LEVEL: 4
       CTEST_PARALLEL_LEVEL: 4
@@ -59,4 +57,4 @@ jobs:
         with:
           fail_ci_if_error: true
           flags: cpp
-          token: ${{ secrets.token }}
+          use_oidc: true

.github/workflows/reusable-python-ci.yml

@@ -2,10 +2,6 @@ name: 🐍 • CI
 
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       setup-z3:
         description: "Whether to set up Z3"
@@ -69,8 +65,6 @@ jobs:
       python-version: ${{ matrix.python-version }}
       setup-z3: ${{ inputs.setup-z3 }}
       z3-version: ${{ inputs.z3-version }}
-    secrets:
-      token: ${{ secrets.token }}
 
   python-tests-macos:
     name: 🍎 ${{ matrix.python-version }} ${{ matrix.runs-on }}
@@ -89,8 +83,6 @@ jobs:
       python-version: ${{ matrix.python-version }}
       setup-z3: ${{ inputs.setup-z3 }}
       z3-version: ${{ inputs.z3-version }}
-    secrets:
-      token: ${{ secrets.token }}
 
   python-tests-windows:
     name: 🏁 ${{ matrix.python-version }}
@@ -108,5 +100,25 @@ jobs:
       python-version: ${{ matrix.python-version }}
       setup-z3: ${{ inputs.setup-z3 }}
       z3-version: ${{ inputs.z3-version }}
-    secrets:
-      token: ${{ secrets.token }}
+
+  python-coverage-upload:
+    name: 📈
+    needs: [python-tests-ubuntu, python-tests-macos, python-tests-windows]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      # check out the repository (mostly for the codecov config)
+      - uses: actions/checkout@v4
+      # download coverage reports from all jobs
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: coverage-*
+          path: coverage-reports
+          merge-multiple: true
+      - name: Upload coverage to Codecov
+        uses: codecov/codecov-action@v4
+        with:
+          fail_ci_if_error: true
+          flags: python
+          use_oidc: true

.github/workflows/reusable-python-tests.yml

@@ -1,10 +1,6 @@
 name: 🐍 • Tests
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       runs-on:
         description: "The platform to run the tests on (ubuntu-latest, macos-latest, windows-latest)"
@@ -62,14 +58,13 @@ jobs:
           python-versions: ${{ inputs.python-version }}
       # run the nox minimums session (assumes a nox session named "minimums" exists) with coverage
       - name: Test on 🐍 ${{ inputs.python-version }} with minimal versions
-        run: nox -s minimums-${{ inputs.python-version }} --verbose -- --cov --cov-report=xml
+        run: nox -s minimums-${{ inputs.python-version }} --verbose -- --cov --cov-report=xml:coverage-${{ inputs.python-version }}-${{ inputs.runs-on }}.xml
       # run the nox tests session (assumes a nox session named "tests" exists) with coverage
       - name: Test on 🐍 ${{ inputs.python-version }}
-        run: nox -s tests-${{ inputs.python-version }} --verbose -- --cov --cov-report=xml --cov-append
-      # upload coverage to Codecov
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        run: nox -s tests-${{ inputs.python-version }} --verbose -- --cov --cov-report=xml:coverage-${{ inputs.python-version }}-${{ inputs.runs-on }}.xml --cov-append
+      # upload the report as an artifact to GitHub so that it can later be uploaded to Codecov
+      - name: Upload coverage report for 🐍 ${{ inputs.python-version }} on ${{ inputs.runs-on }}
+        uses: actions/upload-artifact@v4
         with:
-          fail_ci_if_error: true
-          flags: python
-          token: ${{ secrets.token }}
+          name: coverage-${{ inputs.python-version }}-${{ inputs.runs-on }}
+          path: coverage-*