Fix codecov

.github/workflows/build-tag.yaml

@@ -50,6 +50,9 @@ jobs:
   build:
     needs: lint
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # codecov OIDC upload auth
     strategy:
       fail-fast: false
       matrix:
@@ -72,6 +75,11 @@ jobs:
         uv run coverage xml
     - name: Upload test coverage
       uses: codecov/codecov-action@v7
+      with:
+        # Tokenless uploads are rejected outside fork PRs; OIDC authenticates
+        # tag builds. fail_ci_if_error stays off here: a codecov outage must
+        # not block a release (publish depends on this job).
+        use_oidc: true
   publish:
     needs: build
     if: github.event_name != 'pull_request'

.github/workflows/build.yaml

@@ -51,6 +51,9 @@ jobs:
   build:
     needs: lint
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write  # codecov OIDC upload auth
     strategy:
       fail-fast: false
       matrix:
@@ -100,3 +103,13 @@ jobs:
         uv run coverage xml
     - name: Upload test coverage
       uses: codecov/codecov-action@v7
+      with:
+        # Tokenless uploads are rejected on the protected main branch ("Token
+        # required because branch is protected"), which left codecov comparing
+        # PRs against a stale base. OIDC authenticates uploads from this repo;
+        # fork PRs still fall back to tokenless.
+        use_oidc: true
+        # Surface upload failures on branch pushes so the main base report
+        # can't silently go stale again, without letting codecov outages
+        # block PRs or the merge queue.
+        fail_ci_if_error: ${{ github.event_name == 'push' }}

pyproject.toml

@@ -210,3 +210,12 @@ markers = [
 ]
 pythonpath = ["."]
 asyncio_mode = "auto"
+
+[tool.coverage.run]
+# Without `source`, files never imported by the test run are invisible to
+# coverage and silently inflate the total reported to codecov.
+source = ['dapr', 'flask_dapr']
+# Leading ** keeps the pattern cwd-independent: coverage absolutizes
+# non-wildcard patterns against the invocation directory, so a bare
+# 'dapr/proto/**' only matches when run from the repo root.
+omit = ['**/dapr/proto/**']