CI: use a token for the Codecov action to upload

[rgommers]

This is required now, it was a breaking change in codecov-action@v4. Follows up on #479 (comment).

The token didn't exist yet; I just added it as a repository secret.

[rgommers]

The warnings are gone from the Summary page on this PR, and the CI log ends with:

 info - 2024-08-02 13:28:04,196 -- Your upload is now processing. When finished, results will be available at: https://app.codecov.io/github/mesonbuild/meson-python/commit/044b2e85977eb151f8ffdf7c5252be93309b94ad
info - 2024-08-02 13:28:04,388 -- Process Upload complete

Full output for posterity:

evenName: pull_request
baseRef: mesonbuild:main | headRef: rgommers:add-codecov-token
==> Fork detected, tokenless uploading used
evenName: pull_request
baseRef: mesonbuild:main | headRef: rgommers:add-codecov-token
==> Fork detected, tokenless uploading used
evenName: pull_request
baseRef: mesonbuild:main | headRef: rgommers:add-codecov-token
==> Fork detected, tokenless uploading used
==> linux OS detected
https://cli.codecov.io/latest/linux/codecov.SHA256SUM
gpg: directory '/home/runner/.gnupg' created
gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
gpg: /home/runner/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Signature made Tue Jul 23 19:03:59 2024 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
==> Uploader SHASUM verified (30681c7b3b06da29dc4cf7a8bbae7b6075f43c184935fa276658400b19a51385  codecov)
==> Running version latest
==> Running version v0.7.3
==> Running git config --global --add safe.directory /home/runner/work/meson-python/meson-python
/usr/bin/git config --global --add safe.directory /home/runner/work/meson-python/meson-python
==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit --git-service github -C 044b2e85977eb151f8ffdf7c5252be93309b94ad
info - 2024-08-02 13:28:01,899 -- ci service found: github-actions
info - 2024-08-02 13:28:01,911 -- The PR is happening in a forked repo. Using tokenless upload.
info - 2024-08-02 13:28:02,003 -- Process Commit creating complete
==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-report'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-report --git-service github -C 044b2e85977eb151f8ffdf7c5252be93309b94ad
info - 2024-08-02 13:28:02,763 -- ci service found: github-actions
info - 2024-08-02 13:28:02,852 -- Process Report creating complete
info - 2024-08-02 13:28:02,852 -- Finished creating report successfully --- {"response": "{\"external_id\":\"41236f0d-2c20-4ee7-84c8-21807a3da1f9\",\"created_at\":\"2024-08-02T13:24:47.564569Z\",\"commit_sha\":\"044b2e85977eb151f8ffdf7c5252be93309b94ad\",\"code\":null}"}
==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov do-upload'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov do-upload --git-service github -C 044b2e85977eb151f8ffdf7c5252be93309b94ad
info - 2024-08-02 13:28:03,619 -- ci service found: github-actions
warning - 2024-08-02 13:28:03,631 -- xcrun is not installed or can't be found.
warning - 2024-08-02 13:28:03,637 -- No gcov data found.
info - 2024-08-02 13:28:03,637 -- Generating coverage.xml report in /home/runner/work/meson-python/meson-python
info - 2024-08-02 13:28:04,004 -- Wrote XML report to coverage.xml
info - 2024-08-02 13:28:04,021 -- Found 1 coverage files to report
info - 2024-08-02 13:28:04,021 -- > /home/runner/work/meson-python/meson-python/coverage.xml
info - 2024-08-02 13:28:04,196 -- Your upload is now processing. When finished, results will be available at: https://app.codecov.io/github/mesonbuild/meson-python/commit/044b2e85977eb151f8ffdf7c5252be93309b94ad
info - 2024-08-02 13:28:04,388 -- Process Upload complete

So this seems to work, and the change is trivial, so I'll go ahead and merge it straight away. Can then check if new data appears in the codecov dashboard for the commit in main.

[rgommers]

Ugh, it uploaded but something is still wrong, since the data isn't appearing correctly:

Looking into it .... slow Friday

[rgommers]

Looks like a regression in v4: codecov/codecov-action#1278. The fix is to explicitly use file: to point the action at the coverage.xml file.