ci: Minor adjustments for dependabot pull requests

[marcospereira]

What?

Two minor changes based on the first PR (#344) opened by dependabot.

• Since it creates a branch in the repository instead of a fork, it runs the workflows twice (one for the PR and one for the push). Therefore, pushes will only run now when it is for the main branch.
• It should not try to upload code coverage.

[marcospereira]

Since it is the main branch, we always want to run all workflows.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 91.31%. Comparing base (376f241) to head (e0d6ac5).
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #345   +/-   ##
=========================================
  Coverage     91.31%   91.31%           
  Complexity     1218     1218           
=========================================
  Files            76       76           
  Lines          3168     3168           
  Branches        493      493           
=========================================
  Hits           2893     2893           
  Misses          164      164           
  Partials        111      111           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[marcospereira]

Updating codecov/codecov-action to version v4 broke Codecov uploading because now a token is required:

https://github.com/codecov/codecov-action/blob/v4/README.md#breaking-changes

Example of broken workflow run:

https://github.com/casid/jte/actions/runs/8571119047

Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token)

The Codecov docs related token setup are here: https://docs.codecov.com/docs/adding-the-codecov-token.

@casid, it seems I can remove e545b7f, but you will need to create the Codecov token.

[casid]

Hi @marcospereira!

Thanks for the hint with the token, I've added it as a secret.

I'm merging this PR now.