Codecov-action supports token-less uploads

[CasperWA]

Removed secret token from the workflow, since the codecov-action now supports token-less uploads for public GitHub repositories. To make sure we only upload to Codecov for the upstream repository (Materials-Consortia/optimade-python-tools) an additional condition for when to upload is added to the upload step.

Added pydantic to requirements_eager.txt.

Using actions/checkout@master, since v2 is not up-to-date, and codecov-action will not work for v2.
Note: This should be updated as soon as they have an up-to-date version.

[codecov]

Codecov Report

Merging #220 into master will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #220   +/-   ##
=======================================
  Coverage   87.15%   87.15%           
=======================================
  Files          42       42           
  Lines        1892     1892           
=======================================
  Hits         1649     1649           
  Misses        243      243

Flag	Coverage Δ
#unittests	87.15% <ø> (ø)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update fe05bd3...351da96. Read the comment docs.

[ml-evs]

This looks sensible, thanks @CasperWA. I'm assuming the pydantic change is to allow dependabot to get us to the latest version that fastapi supports (and that it can handle second-order deps like this)?

[CasperWA]

This looks sensible, thanks @CasperWA. I'm assuming the pydantic change is to allow dependabot to get us to the latest version that fastapi supports (and that it can handle second-order deps like this)?

Actually, I haven't added these CI requirements.txt to dependabot. It was merely to make sure the "eager CI workflow" installs the latest version of pydantic.

[CasperWA]

This looks sensible, thanks @CasperWA. I'm assuming the pydantic change is to allow dependabot to get us to the latest version that fastapi supports (and that it can handle second-order deps like this)?

However, it indeed seems that dependabot can handle second-order dependencies.

Currently it checks/monitors:

• Pipfile
• setup.cfg
• setup.py