From 7c7896baab9f965f7c04721b67f0d41c1927a209 Mon Sep 17 00:00:00 2001
From: Hadrien David <h@driendavid.com>
Date: Tue, 22 Sep 2026 12:17:38 -0400
Subject: [PATCH] ci: authenticate Codecov uploads with GitHub OIDC

---
 .github/workflows/ci.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 31f18bf..999417a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
 
 jobs:
   Compatibility:
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -24,9 +27,8 @@ jobs:
         continue-on-error: true
         uses: codecov/codecov-action@v7.1.0
         with:
+          use_oidc: true
           flags: ${{ matrix.tox_env }},python-${{ matrix.python }}
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   Tests:
     needs: Compatibility