Pass required permissions to all workflows that use codecov (#20205)

* Update master.yml

* test slurm

* Update constants.py

* test

* revert

---------

Co-authored-by: Sarah Witt <sarah.witt@datadoghq.com>

Author: steveny91

.github/workflows/master.yml

@@ -28,6 +28,10 @@ jobs:
       pytest-args: '-m "not flaky"'
     secrets: inherit
 
+    # needed for codecov in test-target.yml, allows the action to get a JWT signed by Github
+    permissions:
+       id-token: write
+
   publish-test-results:
 
     needs:

.github/workflows/nightly-base-package.yml

@@ -13,6 +13,11 @@ on:
 jobs:
   test:
     uses: ./.github/workflows/test-all.yml
+
+    # needed for codecov in test-target.yml, allows the action to get a JWT signed by Github
+    permissions:
+      id-token: write
+
     with:
       repo: core
 

.github/workflows/pr-all.yml

@@ -17,6 +17,11 @@ concurrency:
 jobs:
   test:
     uses: ./.github/workflows/test-all.yml
+
+    # needed for codecov in test-target.yml, allows the action to get a JWT signed by Github
+    permissions:
+      id-token: write
+
     with:
       repo: core
 

.github/workflows/test-target.yml

@@ -114,6 +114,9 @@ jobs:
       TRACE_CAPTURE_BASE_DIR: "trace-captures"
       TRACE_CAPTURE_LOG: "trace-captures/output.log"
 
+    # needed for codecov in test-target.yml, allows the action to get a JWT signed by Github
+    permissions:
+        id-token: write
     steps:
 
     - name: Set environment variables with sanitized paths