[BUG] "Token required - not valid tokenless upload" for PR from a fork on open source repo

[xdelaruelle]

Describe the bug
PR to the envmodules/modules repo from a fork fail to upload coverage with a Token required - not valid tokenless upload error.

The token is set to Not required in https://app.codecov.io/account/gh/envmodules/org-upload-token

To Reproduce
Fork https://github.com/envmodules/modules and send a PR upstream.

Expected behavior
Coverage upload that comes from PR from a fork should work on this repository.

Regression
Last successful PR report upload was in 2024.
We were using codecov-action@v4 at that time.
At that time the repository was under another org (repository has been moved to another org at the end of 2024)

Product Area
coverage

Versions

• OS: linux, macos arm64
• Git Host: GitHub
• CI/CD: GitHub Actions
• Uploader: codecov-action@v7.0.0

Commit and CI link
Commit SHA: 1ad5b07d398652e768794955eaac0ac166e7585b
CI link: https://github.com/envmodules/modules/actions/runs/31946911437/job/95164281677?pr=679

Entire Codecov output from CI:

Run ${GITHUB_ACTION_PATH}/dist/codecov.sh
       _____          _
      / ____|        | |
     | |     ___   __| | ___  ___ _____   __
     | |    / _ \ / _` |/ _ \/ __/ _ \ \ / /
     | |___| (_) | (_| |  __/ (_| (_) \ V /
      \_____\___/ \__,_|\___|\___\___/ \_/
                              Wrapper-0.2.9
                             
  ==> Detected macos
   -> Downloading https://cli.codecov.io/latest/macos/codecov
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
  100 20.5M  100 20.5M    0     0   113M      0 --:--:-- --:--:-- --:--:--  113M
  ==> Finishing downloading macos:latest
        Version: v11.3.1
   
  gpg: directory '/Users/runner/.gnupg' created
  gpg: /Users/runner/.gnupg/trustdb.gpg: trustdb created
  gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
  gpg: Total number processed: 1
  gpg:               imported: 1
  ==> Verifying GPG signature integrity
   -> Downloading https://cli.codecov.io/latest/macos/codecov.SHA256SUM
   -> Downloading https://cli.codecov.io/latest/macos/codecov.SHA256SUM.sig
   
  gpg: Signature made Thu Jul  9 01:38:02 2026 UTC
  gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
  gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:          There is no indication that the signature belongs to the owner.
        27034E7FDB850E0BBC2C62FF806BB28AED779869
  codecov: OK
  ==> CLI integrity verified
  
   -> Token length: 0
  ==> Running upload-coverage
        ./codecov --verbose upload-coverage --git-service github --pr 679 --sha 1ad5b07d398652e768794955eaac0ac166e7585b --branch xdelaruelle:ci-fix-coverage --gcov-executable gcov
  info - 2026-08-16 13:10:14,881 -- ci service found: github-actions
  debug - 2026-08-16 13:10:14,888 -- versioning system found: <class 'codecov_cli.helpers.versioning_systems.GitVersioningSystem'>
  debug - 2026-08-16 13:10:14,893 -- versioning system found: <class 'codecov_cli.helpers.versioning_systems.GitVersioningSystem'>
  debug - 2026-08-16 13:10:14,898 -- Loading config from /Users/runner/work/modules/modules/codecov.yml
  debug - 2026-08-16 13:10:14,926 -- Starting upload coverage --- {"verbose": true, "auto_load_params_from": null, "codecov_yml_path": null, "enterprise_url": null, "disable_telem": false, "version": "cli-11.3.1", "command": "upload-coverage", "git_service": "github", "pull_request_number": "679", "commit_sha": "1ad5b07d398652e768794955eaac0ac166e7585b", "branch": "xdelaruelle:ci-fix-coverage", "gcov_executable": "gcov", "fail_on_error": false, "slug": "envmodules/modules", "report_code": "default", "network_root_folder": "/Users/runner/work/modules/modules", "files_search_root_folder": "/Users/runner/work/modules/modules", "files_search_exclude_folders": [], "files_search_explicitly_listed_files": [], "recurse_submodules": false, "disable_search": false, "disable_file_fixes": false, "build_code": "31946911437", "build_url": "https://github.com/envmodules/modules/actions/runs/31946911437", "job_code": "macos-tests", "name": "macos-tests - macos", "env_vars": {}, "flags": [], "plugin_names": ["xcode", "gcov", "pycoverage"], "dry_run": false, "use_legacy_uploader": false, "handle_no_reports_found": false, "report_type_str": "coverage", "network_filter": null, "network_prefix": null, "gcov_args": null, "gcov_ignore": null, "gcov_include": null, "swift_project": null, "parent_sha": null}
  debug - 2026-08-16 13:10:14,926 -- Selected preparation plugins --- {"selected_plugins": ["<class 'codecov_cli.plugins.xcode.XcodePlugin'>", "<class 'codecov_cli.plugins.gcov.GcovPlugin'>", "<class 'codecov_cli.plugins.pycoverage.Pycoverage'>"], "cli_config": {}}
  debug - 2026-08-16 13:10:14,926 -- Running preparation plugin: <class 'codecov_cli.plugins.xcode.XcodePlugin'>
  debug - 2026-08-16 13:10:14,926 -- Running xcode plugin...
  debug - 2026-08-16 13:10:14,926 -- DerivedData folder: /Users/runner/Library/Developer/Xcode/DerivedData
  debug - 2026-08-16 13:10:14,926 -- Translating `*.profdata` into `(?s:[^/]*\.profdata)\Z`
  warning - 2026-08-16 13:10:14,926 -- No swift data found.
  debug - 2026-08-16 13:10:14,927 -- Running preparation plugin: <class 'codecov_cli.plugins.gcov.GcovPlugin'>
  debug - 2026-08-16 13:10:14,927 -- Running gcov plugin...
  debug - 2026-08-16 13:10:14,927 -- Translating `*.gcno` into `(?s:[^/]*\.gcno)\Z`
  warning - 2026-08-16 13:10:15,030 -- Running gcov on the following list of files:
  warning - 2026-08-16 13:10:15,030 -- /Users/runner/work/modules/modules/lib/envmodules.gcno
  debug - 2026-08-16 13:10:15,045 -- Running preparation plugin: <class 'codecov_cli.plugins.pycoverage.Pycoverage'>
  warning - 2026-08-16 13:10:15,046 -- coverage.py is not installed or can't be found.
  debug - 2026-08-16 13:10:15,046 -- Collecting relevant files
  debug - 2026-08-16 13:10:15,066 -- Translating `*.*js` into `(?s:[^/]*\.[^/]*js)\Z`
  ...
  debug - 2026-08-16 13:10:15,071 -- Translating `test_cov.xml` into `(?s:test_cov\.xml)\Z`
  info - 2026-08-16 13:10:15,129 -- Found 31 coverage files to report
  debug - 2026-08-16 13:10:15,129 -- Found 4747 network files to report, (4747 without filtering)
  info - 2026-08-16 13:10:15,129 -- > /Users/runner/work/modules/modules/coverage/tcl/init.tcl.in/cobertura.xml
  ...
  info - 2026-08-16 13:10:15,129 -- > /Users/runner/work/modules/modules/lib/envmodules.c.gcov
  info - 2026-08-16 13:10:15,129 -- > /Users/runner/work/modules/modules/envmodules.c.gcov
  debug - 2026-08-16 13:10:15,152 -- Selected uploader to use: <class 'codecov_cli.services.upload.upload_sender.UploadSender'>
  debug - 2026-08-16 13:10:15,158 -- Sending upload request to Codecov
  info - 2026-08-16 13:10:15,320 -- Upload queued for processing complete
  debug - 2026-08-16 13:10:15,320 -- Upload queued for processing result --- {"result": "RequestResult(error=RequestError(code='HTTP Error 400', params={}, description='{\"message\":\"Token required - not valid tokenless upload\"}\\n'), warnings=[], status_code=400, text='{\"message\":\"Token required - not valid tokenless upload\"}\\n')"}

Additional context
This seems very similar to #1842 which required manual intervention by the codecov team.