Pass only the secret the test workflow needs

.github/workflows/run-on-main.yml

@@ -22,15 +22,18 @@ jobs:
   tests:
     name: Tests
     uses: ./.github/workflows/test.yml
-    secrets: inherit
+    # Named rather than inherited: this job runs the Go test suite, and so
+    # executes repository code and its dependency tree. It has no business
+    # holding the release signing keys.
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
   codegen:
     name: Codegen
     uses: ./.github/workflows/verify-gen.yml
   # Tier 2: Expensive integration tests - only run after all fast checks pass
   helm-charts:
     name: Helm Charts
     uses: ./.github/workflows/helm-charts-test.yml
-    secrets: inherit
   e2e-tests:
     name: E2E Tests
     needs: [linting, tests, codegen]

.github/workflows/run-on-pr.yml

@@ -23,7 +23,11 @@ jobs:
   tests:
     name: Tests
     uses: ./.github/workflows/test.yml
-    secrets: inherit
+    # Named rather than inherited: this job runs the Go test suite, and so
+    # executes repository code and its dependency tree. It has no business
+    # holding the release signing keys.
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
   docs:
     name: Docs
     uses: ./.github/workflows/verify-docgen.yml
@@ -34,7 +38,6 @@ jobs:
   helm-charts:
     name: Helm Charts
     uses: ./.github/workflows/helm-charts-test.yml
-    secrets: inherit
   e2e-tests:
     name: E2E Tests
     needs: [linting, tests, docs, codegen]

.github/workflows/test.yml

@@ -2,6 +2,13 @@ name: Tests
 
 on:
   workflow_call:
+    secrets:
+      # Declared so callers can pass this one secret explicitly instead of
+      # `secrets: inherit`. Optional: pull requests from forks receive no
+      # secrets at all, and codecov accepts tokenless uploads for public
+      # repositories, so an empty value degrades rather than fails.
+      CODECOV_TOKEN:
+        required: false
 
 permissions:
   contents: read