chore: Restore environments for codecov upload and nightly wheel upload

Adds environments back to codecov and nightly wheel uploads, but this time with deployment: false,
which ensures that these workflows don't generate a lot of notifications on github.

Author: d-v-b

.github/workflows/gpu_test.yml

@@ -23,6 +23,9 @@ concurrency:
 jobs:
   test:
     name: py=${{ matrix.python-version }}
+    environment:
+      name: codecov-upload
+      deployment: false
     runs-on: gpu-runner
     strategy:
       matrix:
@@ -75,5 +78,5 @@ jobs:
     - name: Upload coverage
       uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3  # v5.3.1
       with:
-        token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
+        token: ${{ secrets.CODECOV_TOKEN }}
         verbose: true # optional (default = false)

.github/workflows/hypothesis.yaml

@@ -23,6 +23,9 @@ jobs:
 
   hypothesis:
     name: Slow Hypothesis Tests
+    environment:
+      name: codecov-upload
+      deployment: false
     runs-on: "ubuntu-latest"
     defaults:
       run:
@@ -92,7 +95,7 @@ jobs:
     - name: Upload coverage
       uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
       with:
-        token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
+        token: ${{ secrets.CODECOV_TOKEN }}
         verbose: true # optional (default = false)
 
     - name: Generate and publish the report

.github/workflows/nightly_wheels.yml

@@ -16,6 +16,9 @@ concurrency:
 jobs:
   build_and_upload_nightly:
     name: Build and upload nightly wheels
+    environment:
+      name: nightly-wheel-upload
+      deployment: false
     runs-on: ubuntu-latest
 
     steps:
@@ -42,4 +45,4 @@ jobs:
         uses: scientific-python/upload-nightly-action@5748273c71e2d8d3a61f3a11a16421c8954f9ecf
         with:
           artifacts_path: dist
-          anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }} # zizmor: ignore[secrets-outside-env]
+          anaconda_nightly_upload_token: ${{ secrets.ANACONDA_ORG_UPLOAD_TOKEN }}

.github/workflows/test.yml

@@ -20,6 +20,9 @@ concurrency:
 jobs:
   test:
     name: os=${{ matrix.os }}, py=${{ matrix.python-version }}, deps=${{ matrix.dependency-set }}
+    environment:
+      name: codecov-upload
+      deployment: false
     defaults:
       run:
         shell: bash
@@ -77,11 +80,14 @@ jobs:
       if: ${{ matrix.dependency-set == 'optional' && matrix.os == 'ubuntu-latest' }}
       uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
       with:
-        token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
+        token: ${{ secrets.CODECOV_TOKEN }}
         verbose: true # optional (default = false)
 
   test-upstream-and-min-deps:
     name: py=${{ matrix.python-version }}-${{ matrix.dependency-set }}
+    environment:
+      name: codecov-upload
+      deployment: false
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -120,7 +126,7 @@ jobs:
     - name: Upload coverage
       uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
       with:
-        token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
+        token: ${{ secrets.CODECOV_TOKEN }}
         verbose: true # optional (default = false)
 
   doctests: