Upgrade Codecov action v4 → v5

[Copilot]

• Fetch latest master branch (FETCH_HEAD)
• Understand the current state and what needs to be merged
• Perform merge from master into current branch
  • Merged with --allow-unrelated-histories due to grafted history
  • Resolved 64 conflicting files
• Resolve merge conflicts
  • Accepted master version for all files except our Codecov change
  • Re-applied Codecov v5 upgrade to postprocess.yml
  • Updated workflow trigger to "CI pipeline for pySDC" (from master)
• Verify the workflow files are correct after merge
• Test that the setup still works
• Run code review and security checks
• Verify CI configuration is valid

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Codecov is dead (again)</issue_title>
<issue_description>Not sure what's going on here, but the codecov bot does not want to play with us anymore.</issue_description>

<agent_instructions>Either fix codecov usage or propose replacements</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Codecov is dead (again) #483

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

To fix the problem, we should explicitly define a permissions block that scopes the GITHUB_TOKEN to the minimal rights needed. Since both check_permission and mirror_to_gitlab (and the elided get_artifacts_from_other_workflow job) only need to read repository contents and interact with pull requests (e.g., for statuses/comments via the external GitLab action), we can set minimal read access at the workflow root, then elevate to pull-requests: write only for the job that needs it, if any. However, the safest and simplest fix without risking breaking current behavior is to add a workflow-level permissions block granting contents: read and pull-requests: write, which is a common least-privilege baseline for CI that mirrors PRs and may report back to them.

Concretely, in .github/workflows/gitlab_ci.yml, we will insert a top-level permissions: section right after the name: and before on:. This will apply to all jobs (including check_permission, mirror_to_gitlab, and get_artifacts_from_other_workflow) since none defines its own permissions. The block will be:

permissions:
  contents: read
  pull-requests: write

No additional imports or methods are required; GitHub Actions interprets this YAML key natively. This change documents and restricts the GITHUB_TOKEN while preserving typical functionality: reading the repository, checking out code, and allowing the GitLab mirroring action to update PRs if it currently does so.

In general, to fix this issue you add a permissions: section either at the top level of the workflow (applies to all jobs) or per job, granting only the scopes actually needed (often contents: read as a baseline). This prevents the jobs from inheriting broader repository defaults.

For this workflow, the simplest fix without changing functionality is to add a top-level permissions: block (between on: and jobs:) that defines a minimal set of permissions. At a minimum, contents: read is needed for checkouts and for actions that read repository data; other capabilities such as managing pull requests or issues are not used directly in the snippet shown. The actions-cool/check-user-permission action and jakob-fritz/github2lab_action both operate using the GITHUB_TOKEN but do not obviously require write permissions here. Therefore we can safely set:

permissions:
  contents: read

This applies to all three jobs (check_permission, mirror_to_gitlab, and get_artifacts_from_other_workflow). No additional imports or methods are needed; this is a pure YAML configuration change within .github/workflows/gitlab_ci.yml.

In general, the fix is to add an explicit permissions block either at the workflow root (to apply to all jobs) or per job, granting only the minimal permissions needed. For this workflow, contents: read is a safe baseline, and additional permissions can be granted only where clearly required. The mirror_to_gitlab job uses secrets.GITHUB_TOKEN in an action that likely needs to read repo contents and CI status but not push code, so contents: read is appropriate. The get_artifacts_from_other_workflow job uses actions/github-script to list workflow runs and curl plus an explicit token for runs/artifacts; for listing and reading artifacts, actions: read and contents: read are sufficient, and write-level scopes are not needed.

The single best minimally invasive change that satisfies CodeQL is to add a root-level permissions block after the on: key with restrictive settings, e.g. contents: read and actions: read. This will apply to all jobs (check_permission, mirror_to_gitlab, and get_artifacts_from_other_workflow) since none define their own permissions. No other functional changes are necessary because these jobs are already using the default GITHUB_TOKEN; we are only reducing its capabilities to the level needed for read-only operations against code and workflows.

Concretely, in .github/workflows/gitlab_ci.yml, insert:

permissions:
  contents: read
  actions: read

between the on: block (ending at line 10) and the jobs: block (line 12). No imports or additional methods are required.