[BUG] upload creates files in the project root, leaving the repo dirty

[nyurik]

Describe the bug
After running codecov/codecov-action@v5, the repository root has three unexpected new untracked files:
codecov, codecov.SHA256SUM, and codecov.SHA256SUM.sig, making some subsequent operations fail.

See https://github.com/fast-pack/FastPFOR-rs/actions/runs/14274678522/job/40015342209 (should be available for the next few days/weeks.

To Reproduce

• create a code coverage report at the target/llvm-cov/codecov.info
• run this code step:

- uses: codecov/codecov-action@v5
  with:
    token: ${{ secrets.CODECOV_TOKEN }}
    files: target/llvm-cov/codecov.info
    fail_ci_if_error: true

Expected behavior
no new files

Regression
not certain

Versions

• OS: linux
• Git Host: GitHub
• CI/CD: GitHub Actions
• Uploader: codecov-action@v5.4.0 - 0565863

Commit and CI link
https://github.com/fast-pack/FastPFOR-rs/actions/runs/14274678522/job/40015342209

[oldratlee]

+1

https://github.com/foldright/cffu/actions/runs/14287254761/job/40043836761#step:12:17