From 8b8671e8c704d4beda0cd3da06816d86e3204728 Mon Sep 17 00:00:00 2001
From: Rusty Conover <rusty@conover.me>
Date: Wed, 2 Sep 2026 09:43:47 -0400
Subject: [PATCH] ci: authenticate Codecov uploads with OIDC

---
 .github/workflows/coverage.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/coverage.yaml b/.github/workflows/coverage.yaml
index 445d94016..37fc4ce65 100644
--- a/.github/workflows/coverage.yaml
+++ b/.github/workflows/coverage.yaml
@@ -37,6 +37,9 @@ jobs:
   coverage:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@v7
@@ -56,4 +59,6 @@ jobs:
       - name: Upload coverage to codecov
         uses: codecov/codecov-action@v7
         with:
+          fail_ci_if_error: true
           files: '_coverage/coverage.info,_coverage/r_coverage.json,_coverage/python_coverage.xml'
+          use_oidc: true