chore(ci): remove dead Codecov upload steps + lock pins

.github/workflows/tailscale-connect-reusable.yml

@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: MPL-2.0
+# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
+#
+# tailscale-connect-reusable.yml — shared "join the tailnet" step for CI jobs that
+# must reach private endpoints (internal servers, staging DBs, self-hosted
+# registries) from a GitHub-hosted runner.
+#
+# Tailscale has no GitHub App; its GitHub integration is this Action plus a
+# Tailscale OAuth client. The two secrets below must exist on the repo, org or
+# environment that calls this workflow:
+#   TS_OAUTH_CLIENT_ID, TS_OAUTH_SECRET   (Tailscale admin -> OAuth clients, scope auth_keys)
+#
+# Callers opt in per job; nothing here changes CI unless a workflow calls it.
+name: Tailscale connect (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      tags:
+        description: 'Tailscale tags to apply to the ephemeral CI node'
+        required: false
+        type: string
+        default: 'tag:ci'
+      ping:
+        description: 'Comma-separated tailnet hosts to ping for readiness'
+        required: false
+        type: string
+        default: ''
+      version:
+        description: 'Tailscale client version pin (empty = action default)'
+        required: false
+        type: string
+        default: ''
+
+permissions:
+  contents: read
+
+jobs:
+  connect:
+    name: Join tailnet
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      # Pinned per estate policy (SHA pins everywhere); refresh with actions-lock.
+      - name: Connect to Tailscale
+        uses: tailscale/github-action@v4
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          tags: ${{ inputs.tags }}
+          version: ${{ inputs.version }}
+          ping: ${{ inputs.ping }}

config/settings/actions-allowlist.json

@@ -28,6 +28,7 @@
   "github_owned_allowed": true,
   "verified_allowed": true,
   "patterns_allowed": [
+    "tailscale/github-action@*",
     "8398a7/action-slack@*",
     "actions-rust-lang/setup-rust-toolchain@*",
     "ad-m/github-push-action@*",
@@ -121,5 +122,5 @@
     "trufflesecurity/trufflehog@*",
     "webfactory/ssh-agent@*"
   ],
-  "enforcement_note": "verified_allowed is TRUE, so Marketplace-verified creators (Snyk, Codecov, SonarSource, Semgrep, ...) run whether or not they appear in patterns_allowed. The 118→92 prune is therefore HYGIENE: R1 is enforced by deleting the workflows in the sweep, not by this list. Flipping verified_allowed to false is a separate decision (O12) taken only after a uses: census proves every verified-creator action still in use is on patterns_allowed."
+  "enforcement_note": "[2026-09-20 sweep] Workflow-side Codecov/Snyk references are now deleted across both estates, so the prune recorded above is safe to apply. Caveat unchanged: verified_allowed is TRUE, so Marketplace-verified creators (Snyk, Codecov, SonarSource, Semgrep, ...) run whether or not they appear in patterns_allowed. The 118→92 prune is therefore HYGIENE: R1 is enforced by deleting the workflows in the sweep, not by this list. Flipping verified_allowed to false is a separate decision (O12) taken only after a uses: census proves every verified-creator action still in use is on patterns_allowed."
 }

rhodium-standard-repositories/actions-allowlist/allowed-actions.json

@@ -2,6 +2,7 @@
   "github_owned_allowed": true,
   "verified_allowed": true,
   "patterns_allowed": [
+    "tailscale/github-action@*",
     "8398a7/action-slack@*",
     "actions-rust-lang/setup-rust-toolchain@*",
     "ad-m/github-push-action@*",
@@ -18,7 +19,6 @@
     "Bogdanp/setup-racket@*",
     "cachix/install-nix-action@*",
     "cbrgm/cleanup-stale-branches-action@*",
-    "codecov/codecov-action@*",
     "cometkim/rclone-actions@*",
     "DavidAnson/markdownlint-cli2-action@*",
     "dawidd6/action-download-artifact@*",
@@ -83,7 +83,6 @@
     "rustsec/audit-check@*",
     "shivammathur/setup-php@*",
     "slsa-framework/slsa-github-generator@*",
-    "snyk/actions@*",
     "softprops/action-gh-release@*",
     "SonarSource/sonarcloud-github-action@*",
     "SonarSource/sonarqube-scan-action@*",

rhodium-standard-repositories/examples/enterprise-service/.github/workflows/ci.yml

@@ -58,5 +58,3 @@ jobs:
         run: cargo install cargo-tarpaulin
       - name: Generate coverage
         run: cargo tarpaulin --out Xml
-      - name: Upload coverage
-        uses: codecov/codecov-action@v3

rhodium-standard-repositories/satellites/rsr-certifier/.github/workflows/rust-ci.yml

@@ -51,6 +51,3 @@ jobs:
         run: cargo install cargo-tarpaulin
       - name: Generate coverage
         run: cargo tarpaulin --out Xml
-      - uses: codecov/codecov-action@v5
-        with:
-          files: cobertura.xml