From aaa5973b884a3264950bcc53edc0f6de0813335f Mon Sep 17 00:00:00 2001
From: joereyna <joseph.reyna@gmail.com>
Date: Mon, 30 Mar 2026 19:48:33 -0700
Subject: [PATCH] Use OIDC for Codecov upload instead of static token

---
 .github/workflows/test-litellm-matrix.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test-litellm-matrix.yml b/.github/workflows/test-litellm-matrix.yml
index b49eee0ba91..41ba6e054c5 100644
--- a/.github/workflows/test-litellm-matrix.yml
+++ b/.github/workflows/test-litellm-matrix.yml
@@ -189,9 +189,9 @@ jobs:
     needs: test
     if: always()
     runs-on: ubuntu-latest
-    # Isolated job — CODECOV_TOKEN is never in scope during test execution
     permissions:
       contents: read
+      id-token: write  # Required for OIDC tokenless upload
 
     steps:
       - name: Download all coverage reports
@@ -203,6 +203,6 @@ jobs:
       - name: Upload to Codecov
         uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695 # v5.5.4
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
           files: "*.xml"
           fail_ci_if_error: false