From a0aa0013eb9bf7be45ba838b7b45f86b4682987e Mon Sep 17 00:00:00 2001
From: Lukas Holecek <hluk@email.cz>
Date: Tue, 9 Jun 2026 08:33:56 +0000
Subject: [PATCH] fix: Switch Codecov to OIDC auth, upgrade to v7, add
 unit-tests flag, scope push to main

Assisted-by: Claude Code (claude-opus-4-6) <noreply@anthropic.com>
---
 .github/workflows/gating.yaml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/gating.yaml b/.github/workflows/gating.yaml
index c7fd7fd..0739729 100644
--- a/.github/workflows/gating.yaml
+++ b/.github/workflows/gating.yaml
@@ -4,6 +4,8 @@ name: Gating
 "on":
   pull_request:
   push:
+    branches:
+      - main
   workflow_dispatch:
     inputs: {}
 
@@ -11,6 +13,9 @@ jobs:
   tests:
     name: Unit tests
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -25,11 +30,12 @@ jobs:
         run: uvx --with tox-uv tox -e py3
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
         with:
           fail_ci_if_error: true
           verbose: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          use_oidc: true
+          flags: unit-tests
 
   linters:
     name: Linters