fix: use OIDC token for Codecov uploads from fork PRs (#736)

.github/workflows/xahau-ga-nix.yml

@@ -230,6 +230,9 @@ jobs:
   build:
     needs: matrix-setup
     runs-on: ${{ fromJSON(matrix.runs_on) }}
+    permissions:
+      id-token: write
+      contents: read
     container:
       image: ubuntu:24.04
       volumes:
@@ -332,7 +335,7 @@ jobs:
           # Install gcovr for coverage jobs
           if [ "${{ matrix.job_type }}" = "coverage" ]; then
             pipx install "gcovr>=7,<9"
-            apt-get install -y lcov
+            apt-get install -y curl lcov
           fi
 
       - name: Check environment
@@ -407,7 +410,8 @@ jobs:
           cache_version: ${{ env.CACHE_VERSION }}
           main_branch: ${{ env.MAIN_BRANCH_NAME }}
           stdlib: ${{ matrix.stdlib }}
-          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
+          # Coverage builds are slower due to instrumentation; use fewer parallel jobs to avoid flakiness
+          cmake-args: '-Dcoverage=ON -Dcoverage_format=xml -Dcoverage_test_parallelism=$(($(nproc)/2)) -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_CXX_FLAGS="-O0" -DCMAKE_C_FLAGS="-O0"'
           cmake-target: 'coverage'
           ccache_max_size: '100G'
 
@@ -452,15 +456,11 @@ jobs:
 
       - name: Upload coverage report
         if: matrix.job_type == 'coverage'
-        uses: wandalen/wretry.action/main@v3
+        uses: codecov/codecov-action@v5
         with:
-          action: codecov/codecov-action@v4.3.0
-          with: |
-            files: coverage.xml
-            fail_ci_if_error: true
-            disable_search: true
-            verbose: true
-            plugin: noop
-            token: ${{ secrets.CODECOV_TOKEN }}
-          attempt_limit: 5
-          attempt_delay: 210000 # in milliseconds
+          files: coverage.xml
+          fail_ci_if_error: true
+          disable_search: true
+          verbose: true
+          plugins: noop
+          use_oidc: true