Update Codecov action to v4

[TheJulianJES]

Note

Please read the comment below this on how these PRs should be merged: #17 (comment)
(TL;DR -> this PR first, then restart CI on linked PRs, then mark those as ready and merge when CI passes)

Proposed change

Updates the Codecov action to v4.
This version now requires a Codecov token. This is provided as a different GitHub secret on each zigpy repo.
All individual workflows will need to be updated to pass the CODECOV_TOKEN secret to this shared workflow.

When a repo is forked, the GitHub secret will return an empty string. (Hopefully, still satisfying the required property in this shared workflow -- needs testing first). Codecov v4 detects that it's running on a fork and will use tokenless uploads, ignoring the empty token/secret. These tokenless updates can still hit the global GitHub API rate limit, but at least our repo commits won't.

There also seem to be some issues with v3 at the moment where it barely works at all. I'm not sure if they're related to the GH API rate limit or by some codecov issue, but v4 seems to work a lot better, even with tokenless uploads. (tested in HA repo)

Corresponding PRs for all repos using the shared workflow:

• bellows: Support Codecov v4 changes bellows#615
• zha-quirks: Support Codecov v4 changes zha-device-handlers#3105
• zha: Support Codecov v4 changes zha#46
• zigpy-deconz: Support Codecov v4 changes zigpy-deconz#254
• zigpy-xbee: Support Codecov v4 changes zigpy-xbee#175
• zigpy-zigate: Support Codecov v4 changes zigpy-zigate#153
• zigpy-znp: Support Codecov v4 changes zigpy-znp#245
• zigpy: Support Codecov v4 changes zigpy#1380

[TheJulianJES]

I've had some PRs temporarily point at my workflows branch for testing. That's why you might see a codecov comment on those. They now all point back to the main workflow, so CI won't run for now until this is merged and CI restarted.
The PRs should all be ready now.

---

This workflows PR needs to be merged first. Then, the jobs need to be restarted on all linked PRs above (you can just close/open the PR to restart CI). After CI has passed on the individual PRs, they can be merged, too.

The only exception is the ZHA repo. It currently uses a branch of this repo (with xdist). After this workflows PR has been merged, that commit should also be added to the custom branch used for ZHA.
It should be enough to click "Update Branch" on #15 after this has been merged (and either merge dev or rebase).

[puddly]

Looks good to me. There's only one way to test GitHub actions 😄

[TheJulianJES]

I'll merge all children PRs now, too. For testing purposes, I had the quirks PR done from a branch on the main repo (to use the token upload which works "all of the time").
The other PRs were created from a fork of mine and will all use "tokenless uploading" until merged. (Then, the commits are on the main repo run with token upload).

Right now, the rate limit is hit again for the tokenless uploads (that can still happen sometimes): "Tokenless has reached GitHub rate limit" in the logs.
The PRs can still be merged though without waiting, as Codecov will rerun (with token upload) on the dev branch and succeed there.

EDIT: All merged and everything seems to be working as expected: 🎉