Update codecov action to v4

.github/workflows/_test.yml

@@ -9,6 +9,9 @@ on:
         type: string
         description: The runner to run this job on
         required: true
+    secrets:
+      CODECOV_TOKEN:
+        required: true
 
 env:
   # https://github.com/pytest-dev/pytest/issues/2042
@@ -40,7 +43,9 @@ jobs:
         run: tox -e pytest
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
           name: ${{ inputs.python-version }}/${{ inputs.runs-on }}
           files: cov.xml
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/ci.yml

@@ -22,6 +22,8 @@ jobs:
     with:
       python-version: dev
       runs-on: ubuntu-latest
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   docs:
     needs: check

template/{% if git_platform=="github.com" %}.github{% endif %}/workflows/ci.yml.jinja

@@ -31,6 +31,8 @@ jobs:
     with:
       runs-on: ${{ matrix.runs-on }}
       python-version: ${{ matrix.python-version }}
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 {% endraw %}{% if docker %}
   container:
     needs: check

template/{% if sphinx %}docs{% endif %}/developer/how-to/coverage.md

@@ -0,0 +1,8 @@
+
+# How to check code coverage
+
+Code coverage is reported to the command line and to a `cov.xml` file by the command `tox -e pytest`. The file is uploaded to the Codecov service in CI.
+
+## Adding a Codecov Token
+
+If the repo is not hosted in DiamondLightSource, then you need to visit `https://app.codecov.io/account/gh/<org_name>/org-upload-token` to generate a token for your org, and store it as a secret named `CODECOV_TOKEN` in `https://github.com/organizations/<org_name>/settings/secrets/actions`