🔧 use OpenID Connect (OIDC) instead of CODECOV_TOKEN secret

cda-tum · May 24, 2024 · 4be698a · 4be698a
1 parent d485d10
commit 4be698a
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 16 deletions.
diff --git a/.github/workflows/reusable-cpp-ci.yml b/.github/workflows/reusable-cpp-ci.yml
@@ -1,10 +1,6 @@
 name: 🇨‌ • CI
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       cmake-args:
         description: "Additional arguments to pass to CMake on every OS"
@@ -69,8 +65,6 @@ jobs:
   coverage:
     name: 📈
     uses: ./.github/workflows/reusable-cpp-coverage.yml
-    secrets:
-      token: ${{ secrets.token }}
     with:
       cmake-args: ${{ inputs.cmake-args }} ${{ inputs.cmake-args-ubuntu }}
       setup-z3: ${{ inputs.setup-z3 }}

diff --git a/.github/workflows/reusable-cpp-coverage.yml b/.github/workflows/reusable-cpp-coverage.yml
@@ -1,10 +1,6 @@
 name: 🇨 • Coverage
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       cmake-args:
         description: "Additional arguments to pass to CMake"
@@ -23,6 +19,8 @@ jobs:
   coverage:
     name: 📈 Coverage
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     env:
       CMAKE_BUILD_PARALLEL_LEVEL: 4
       CTEST_PARALLEL_LEVEL: 4
@@ -59,4 +57,4 @@ jobs:
         with:
           fail_ci_if_error: true
           flags: cpp
-          token: ${{ secrets.token }}
+          use_oidc: true
diff --git a/.github/workflows/reusable-python-ci.yml b/.github/workflows/reusable-python-ci.yml
@@ -2,10 +2,6 @@ name: 🐍 • CI
 
 on:
   workflow_call:
-    secrets:
-      token:
-        description: "The token to use for Codecov"
-        required: true
     inputs:
       setup-z3:
         description: "Whether to set up Z3"
@@ -123,4 +119,4 @@ jobs:
         with:
           fail_ci_if_error: true
           flags: python
-          token: ${{ secrets.token }}
+          use_oidc: true