CI improvements - switch codecov to OIDC & aggregate CI results

.github/workflows/benchmark.yml

@@ -1,18 +1,11 @@
 name: Benchmark
 
 on:
-  push:
-    branches:
-      - main
-  pull_request:
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: '1'

.github/workflows/ci.yml

@@ -84,6 +84,9 @@ jobs:
     name: Code Coverage
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
     - name: Checkout code
@@ -112,13 +115,11 @@ jobs:
         retention-days: 30
 
     - name: Upload to Codecov
-      if: env.CODECOV_TOKEN != ''
       uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         files: lcov.info
         fail_ci_if_error: true
-      env:
-        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        use_oidc: true
 
   fmt:
     name: Formatting
@@ -244,12 +245,25 @@ jobs:
     - name: Run actionlint
       uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
 
+  cross-platform:
+    name: Cross Platform
+    uses: ./.github/workflows/cross-platform.yml
+    permissions:
+      contents: read
+
+  benchmark:
+    name: Benchmark
+    uses: ./.github/workflows/benchmark.yml
+    permissions:
+      contents: write
+      deployments: write
+
   ci-success:
     name: CI Success
     if: always()
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [test, fmt, docs, coverage, fuzz-build, security, minimal-versions, typos, workflow-lint]
+    needs: [test, fmt, docs, coverage, fuzz-build, security, minimal-versions, typos, workflow-lint, cross-platform, benchmark]
     steps:
     - name: Verify all required jobs succeeded
       if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || contains(needs.*.result, 'skipped') }}

.github/workflows/cross-platform.yml

@@ -1,21 +1,14 @@
 name: Cross Platform
 
 on:
-  push:
-    branches: [main, feature/pipeline-test]
-  pull_request:
-    branches: [main]
+  workflow_call:
   schedule:
     # Run weekly to catch regressions
     - cron: '0 0 * * 0'
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 env:
   CARGO_TERM_COLOR: always
   RUST_BACKTRACE: '1'