From 08f5f6b211c5de028e5d1bfb8ea2f98ce4cddbde Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 09:07:16 +0200 Subject: [PATCH 1/5] Revert "gh: drop Codecov token, upload works without one for fork PRs" This reverts commit 87deb87e66442794908cbfb3212de6f0c5e7a2f8. Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 30 ++++++++++++------------------ .github/workflows/macos_tests.yaml | 5 ++--- 2 files changed, 14 insertions(+), 21 deletions(-) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index adf0625c9..522849ee2 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -67,10 +67,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -155,10 +154,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -239,10 +237,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -308,10 +305,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -379,10 +375,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: @@ -525,10 +520,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index 02660c30c..a98615f57 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -62,10 +62,9 @@ jobs: - name: Uninstall Modules run: | make uninstall - # no token needed: public repo uses Codecov's tokenless upload via - # GitHub OIDC, which also works for pull requests coming from forks - # (base repo secrets are never exposed to fork-triggered PR runs) - uses: codecov/codecov-action@v7 + with: + token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() with: From 85c6cbd53028d50377c91118ca25235c4ae574a9 Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 11:22:31 +0200 Subject: [PATCH 2/5] gh: enable verbosity of codecov action Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 6 ++++++ .github/workflows/macos_tests.yaml | 1 + 2 files changed, 7 insertions(+) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index 522849ee2..23f8442b3 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -69,6 +69,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -156,6 +157,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -239,6 +241,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -307,6 +310,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -377,6 +381,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() @@ -522,6 +527,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index a98615f57..e97daca4b 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -64,6 +64,7 @@ jobs: make uninstall - uses: codecov/codecov-action@v7 with: + verbose: true token: ${{ secrets.CODECOV_TOKEN }} - uses: actions/upload-artifact@v7 if: failure() From f9becc284394907d68928fa0c8723fd0b3cf6c97 Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 11:30:27 +0200 Subject: [PATCH 3/5] gh: adapt triggers to avoid running actions on forked repo Signed-off-by: Xavier Delaruelle --- .github/workflows/completion_tests.yaml | 9 ++++++--- .github/workflows/easybuild_tests.yaml | 9 ++++++--- .github/workflows/lint_tests.yaml | 9 ++++++--- .github/workflows/linux_tests.yaml | 9 ++++++--- .github/workflows/macos_tests.yaml | 9 ++++++--- .github/workflows/windows_tests.yaml | 9 ++++++--- 6 files changed, 36 insertions(+), 18 deletions(-) diff --git a/.github/workflows/completion_tests.yaml b/.github/workflows/completion_tests.yaml index cbccf5a76..3a6fd0818 100644 --- a/.github/workflows/completion_tests.yaml +++ b/.github/workflows/completion_tests.yaml @@ -2,10 +2,13 @@ name: completion-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/easybuild_tests.yaml b/.github/workflows/easybuild_tests.yaml index 45f620f03..382560a40 100644 --- a/.github/workflows/easybuild_tests.yaml +++ b/.github/workflows/easybuild_tests.yaml @@ -2,10 +2,13 @@ name: easybuild-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/lint_tests.yaml b/.github/workflows/lint_tests.yaml index ee3a63696..7748be70f 100644 --- a/.github/workflows/lint_tests.yaml +++ b/.github/workflows/lint_tests.yaml @@ -2,10 +2,13 @@ name: lint-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index 23f8442b3..ba4c0c859 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -2,10 +2,13 @@ name: linux-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index e97daca4b..0f99370b1 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -2,10 +2,13 @@ name: macos-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read diff --git a/.github/workflows/windows_tests.yaml b/.github/workflows/windows_tests.yaml index c26f15db7..7f281e2fc 100644 --- a/.github/workflows/windows_tests.yaml +++ b/.github/workflows/windows_tests.yaml @@ -2,10 +2,13 @@ name: windows-tests on: push: - branches-ignore: - - c-main - - c-3.2 + branches: + - main + - v*.*.x pull_request: + branches: + - main + - v*.*.x permissions: contents: read From 1a58db108647d28efc7870553a06cc974fd93f50 Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sun, 16 Aug 2026 11:32:35 +0200 Subject: [PATCH 4/5] gh: use default permissions for jobs uploading coverage Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 3 --- .github/workflows/macos_tests.yaml | 3 --- 2 files changed, 6 deletions(-) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index ba4c0c859..07bdc43b7 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -10,9 +10,6 @@ on: - main - v*.*.x -permissions: - contents: read - jobs: tcl86-nolibtclenvmodules: runs-on: ubuntu-22.04 diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index 0f99370b1..6fe4dd833 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -10,9 +10,6 @@ on: - main - v*.*.x -permissions: - contents: read - jobs: macos: runs-on: macos-15 From 2bbf22b4762848b6ef444632f25308bdcbfb99d6 Mon Sep 17 00:00:00 2001 From: Xavier Delaruelle Date: Sat, 15 Aug 2026 16:50:46 +0200 Subject: [PATCH 5/5] gh: turn on Codecov identity-token upload path The no-token upload path lets Codecov verify a run through a GitHub Actions identity token, but codecov-action only requests that token when its own opt-in input for it is enabled, and the job running the step needs the id-token permission to obtain the token in the first place. Neither was set, so the action fell back to a legacy PR-label identification method that Codecov rejects with a "Token required" error. Grant id-token: write and turn on that opt-in input on the jobs that upload coverage. Assisted-by: Claude:claude-sonnet-5 Signed-off-by: Xavier Delaruelle --- .github/workflows/linux_tests.yaml | 42 +++++++++++++++++++++++++----- .github/workflows/macos_tests.yaml | 7 ++++- 2 files changed, 42 insertions(+), 7 deletions(-) diff --git a/.github/workflows/linux_tests.yaml b/.github/workflows/linux_tests.yaml index 07bdc43b7..29c9eb1a7 100644 --- a/.github/workflows/linux_tests.yaml +++ b/.github/workflows/linux_tests.yaml @@ -13,6 +13,8 @@ on: jobs: tcl86-nolibtclenvmodules: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.6 @@ -67,10 +69,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -82,6 +87,8 @@ jobs: tcl85-nolibtclenvmodules: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.5 @@ -155,10 +162,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -170,6 +180,8 @@ jobs: tcl85-2: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.5 @@ -239,10 +251,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -254,6 +269,8 @@ jobs: tcl86: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.6 @@ -308,10 +325,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -323,6 +343,8 @@ jobs: tcl85: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh8.5 @@ -379,10 +401,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: @@ -475,6 +500,8 @@ jobs: tcl90: runs-on: ubuntu-22.04 + permissions: + id-token: write env: CONFIGURE_OPTS: | --with-tclsh=tclsh9.0 @@ -525,10 +552,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: diff --git a/.github/workflows/macos_tests.yaml b/.github/workflows/macos_tests.yaml index 6fe4dd833..52b1adf28 100644 --- a/.github/workflows/macos_tests.yaml +++ b/.github/workflows/macos_tests.yaml @@ -13,6 +13,8 @@ on: jobs: macos: runs-on: macos-15 + permissions: + id-token: write env: CONFIGURE_OPTS: | --prefix=/tmp/modules @@ -62,10 +64,13 @@ jobs: - name: Uninstall Modules run: | make uninstall + # no token needed: id-token permission above lets Codecov verify + # this public repo via GitHub OIDC, which also works for pull + # requests from forks (base repo secrets are never exposed there) - uses: codecov/codecov-action@v7 with: verbose: true - token: ${{ secrets.CODECOV_TOKEN }} + use_oidc: true - uses: actions/upload-artifact@v7 if: failure() with: