From 3e3e1ca580ece0bbb4bfff5277047b582f4d6181 Mon Sep 17 00:00:00 2001
From: Petr Toman <ptoman@redhat.com>
Date: Wed, 3 Jun 2026 12:58:51 +0200
Subject: [PATCH] fix: switch Codecov to OIDC auth and add unit-tests flag

- Switch from token-based auth to OIDC (more secure, no secret needed)
- Add flags: unit-tests for proper coverage categorization
- Add files: codecov.json to explicitly specify coverage file
- Add permissions: id-token: write required for OIDC

Ref: COVERPORT-251

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/codecov.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/codecov.yaml b/.github/workflows/codecov.yaml
index a766d506f..48bb04283 100644
--- a/.github/workflows/codecov.yaml
+++ b/.github/workflows/codecov.yaml
@@ -21,6 +21,8 @@ jobs:
 
   ci:
     runs-on: ubuntu-24.04
+    permissions:
+      id-token: write
 
     steps:
       - name: Maximize build space
@@ -77,5 +79,7 @@ jobs:
       - uses: codecov/codecov-action@v5
         if: github.repository_owner == 'guacsec'
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
+          flags: unit-tests
+          files: codecov.json
           slug: guacsec/trustify