Pass CODECOV_TOKEN explicitly and pin shared workflows to v19

Author: jeromekelleher

.github/workflows/docs.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   Docs:
-    uses: tskit-dev/.github/.github/workflows/docs.yml@v18
+    uses: tskit-dev/.github/.github/workflows/docs.yml@v19
     with:
       pyproject-directory: python
       additional-apt-packages: doxygen

.github/workflows/lint.yml

@@ -9,6 +9,6 @@ permissions:
 
 jobs:
   Lint:
-    uses: tskit-dev/.github/.github/workflows/lint.yml@v18
+    uses: tskit-dev/.github/.github/workflows/lint.yml@v19
     with:
       pyproject-directory: python

.github/workflows/tests.yml

@@ -16,36 +16,39 @@ jobs:
 
   packaging:
     name: Python packaging
-    uses: tskit-dev/.github/.github/workflows/python-packaging.yml@v18
+    uses: tskit-dev/.github/.github/workflows/python-packaging.yml@v19
     with:
       pyproject-directory: python
       cli-test-cmd: tskit --help
 
   test-c:
     name: C tests
-    uses: tskit-dev/.github/.github/workflows/c-tests.yml@v18
+    uses: tskit-dev/.github/.github/workflows/c-tests.yml@v19
     with:
       library-directory: c
-    secrets: inherit  # zizmor: ignore[secrets-inherit] trusted first-party tskit-dev reusable workflow; needs CODECOV_TOKEN
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   test-python-c:
     name: Python-C tests
-    uses: tskit-dev/.github/.github/workflows/python-c-tests.yml@v18
+    uses: tskit-dev/.github/.github/workflows/python-c-tests.yml@v19
     with:
       tests: python/tests/test_python_c.py python/tests/test_dict_encoding.py
       pyproject-directory: python
-    secrets: inherit  # zizmor: ignore[secrets-inherit] trusted first-party tskit-dev reusable workflow; needs CODECOV_TOKEN
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
 
   test:
     name: Python
-    uses: tskit-dev/.github/.github/workflows/python-tests.yml@v18
+    uses: tskit-dev/.github/.github/workflows/python-tests.yml@v19
     with:
       os: ${{ matrix.os }}
       python-version: ${{ matrix.python }}
       pyproject-directory: python
       coverage-directory: python/tskit
-    secrets: inherit  # zizmor: ignore[secrets-inherit] trusted first-party tskit-dev reusable workflow; needs CODECOV_TOKEN
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     strategy:
       matrix:
         python: [ 3.11, 3.13 ]

.github/workflows/wheels.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   build-wheels:
     if: "!startsWith(github.ref, 'refs/tags/C_')"
-    uses: tskit-dev/.github/.github/workflows/build-wheels.yml@v18
+    uses: tskit-dev/.github/.github/workflows/build-wheels.yml@v19
     with:
       pyproject-directory: python