Repository: astro-informatics/s2fft (language: python)

Issue:
`codecov` API token exposed in workflow file
Currently the Codecov API token is included directly in the workflow file:

https://github.com/astro-informatics/s2fft/blob/2c3d9e5af52940846b265d8912fc7ab0296f6891/.github/workflows/tests.yml#L38

In general tokens like this should be stored as a GitHub Actions [secret](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) (see for example [this guide in Codecov documentation](https://docs.codecov.com/docs/adding-the-codecov-token](https://docs.codecov.com/docs/adding-the-codecov-token#github-actions))). Ideally we should also use the [`codecov-action` GitHub Actions action](https://github.com/codecov/codecov-action) to upload. 




Discussion / hints:

Fix patch:
diff --git a/pyproject.toml b/pyproject.toml
index 75f6777b..6a2c310b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -73,7 +73,6 @@ plotting = [
 tests = [
     "pytest",
     "pytest-cov",
-    "codecov",
     "so3",
 ]
 


Test patch:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 95df0989..64d46184 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -32,5 +32,9 @@ jobs:
     
     - name: Run tests
       run: |
-        pytest --cov-report term --cov=s2fft --cov-config=.coveragerc 
-        codecov --token 298dc7ee-bb9f-4221-b31f-3576cc6cb702
+        pytest --cov-report=xml --cov=s2fft --cov-config=.coveragerc
+  
+    - name: Upload coverage reports to Codecov
+      uses: codecov/codecov-action@v3
+      env:
+        CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}