move codecov from token to oidc

Author: bckohan

.github/workflows/release.yml

@@ -25,9 +25,8 @@ jobs:
     permissions:
       contents: read
       actions: write
+      id-token: write
     uses: ./.github/workflows/test.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   build:
     name: Build Package

.github/workflows/test.yml

@@ -18,9 +18,6 @@ on:
       - "justfile"
   merge_group:
   workflow_call:
-    secrets:
-      CODECOV_TOKEN:
-        required: true
   workflow_dispatch:
     inputs:
       debug:
@@ -776,11 +773,9 @@ jobs:
   coverage-combine:
     needs: [postgres, sqlite, mysql, mariadb, oracle, windows, macos]
     runs-on: ubuntu-latest
-    environment:
-      name: codecov
-      deployment: false  # Prevents creating a GitHub deployment object
     permissions:
       contents: read
+      id-token: write
     steps:
       - name: Clear Tool cache
         if: ${{ github.event.inputs.clear_cache == 'true' }}
@@ -809,6 +804,6 @@ jobs:
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           files:
             ./coverage.xml