gh: turn on Codecov identity-token upload path

The no-token upload path lets Codecov verify a run through a
GitHub Actions identity token, but codecov-action only requests
that token when its own opt-in input for it is enabled, and the
job running the step needs the id-token permission to obtain the
token in the first place. Neither was set, so the action fell
back to a legacy PR-label identification method that Codecov
rejects with a "Token required" error. Grant id-token: write and
turn on that opt-in input on the jobs that upload coverage.

Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Xavier Delaruelle <xavier.delaruelle@cea.fr>

Author: xdelaruelle

.github/workflows/linux_tests.yaml

@@ -13,6 +13,8 @@ on:
 jobs:
   tcl86-nolibtclenvmodules:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.6
@@ -67,10 +69,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -82,6 +87,8 @@ jobs:
 
   tcl85-nolibtclenvmodules:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.5
@@ -155,10 +162,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -170,6 +180,8 @@ jobs:
 
   tcl85-2:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.5
@@ -239,10 +251,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -254,6 +269,8 @@ jobs:
 
   tcl86:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.6
@@ -308,10 +325,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -323,6 +343,8 @@ jobs:
 
   tcl85:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh8.5
@@ -379,10 +401,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
@@ -475,6 +500,8 @@ jobs:
 
   tcl90:
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --with-tclsh=tclsh9.0
@@ -525,10 +552,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with:

.github/workflows/macos_tests.yaml

@@ -13,6 +13,8 @@ on:
 jobs:
   macos:
     runs-on: macos-15
+    permissions:
+      id-token: write
     env:
       CONFIGURE_OPTS: |
         --prefix=/tmp/modules
@@ -62,10 +64,13 @@ jobs:
       - name: Uninstall Modules
         run: |
           make uninstall
+      # no token needed: id-token permission above lets Codecov verify
+      # this public repo via GitHub OIDC, which also works for pull
+      # requests from forks (base repo secrets are never exposed there)
       - uses: codecov/codecov-action@v7
         with:
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
       - uses: actions/upload-artifact@v7
         if: failure()
         with: