[BUG] Tokenless upload result inconsistent between two repository.

[pohanhuangtw]

Describe the bug
When create fork PR to sbombastic's workflow will uploads to the codecov fail, but it works on the kubewarden-controller's workflow
[context]
Common

• Both workflow use the latest v5.4.3 action
• Both codecov.io require the upload global token

Diff (but both of them are fork PR, this diff should not matter)

• secret level
  • sbombastic use repo-level secret to upload
  • kubewarden use the org-level secret to upload

To Reproduce
Steps to reproduce the behavior:

1. Go to sbombastic
2. fork the repo
3. create a PR to upstream repo
4. See error on workflow CI

Expected behavior
Both of the repo should either works on uploading or failing.

Regression

• sbombastic last success, ci: fix codecov report upload rancher-sandbox/sbombastic#192, May 5.
• kubewarden always works

Screenshots

Product Area
If applicable, the product with the given bug (e.g. coverage, test analytics, browser extension, bundle analysis)

Versions

• OS: ubuntu-latest
• Git Host: GitHub
• CI/CD: GitHub Actions
• Uploader: 18283e0 # v5.4.3

Commit and CI link

• Fail one: https://github.com/rancher-sandbox/sbombastic/actions/runs/15831116596/job/44623743699#step:5:381
• Successful one: https://github.com/kubewarden/kubewarden-controller/actions/runs/15619551212/job/44000672312#step:5:393

Additional context
Add any other context about the problem here.

[joseph-sentry]

Hi, if you haven't done so yet, can you check that the "Token authentication for public repositories" setting is set to "not required"?

You can do so by navigating to your org's settings at https://app.codecov.io/account/gh/<org-name>/org-upload-token, and clicking the "Not required" box:

[pohanhuangtw]

Hi @joseph-sentry,
Thanks for the reply!
I don’t have admin access to either organization, so I can’t change that setting myself. Is there another way we can work around this?

I’ve checked the kubewarden org and it does require an upload token—and it looks like rancher-sandbox does as well. Would it be possible for someone with admin privileges to toggle “Token authentication for public repositories” to “Not required,” or is there an alternative approach you’d recommend?

Thanks!