It should be noted that PRs from forks do not have access to repository secrets, so this fix only applies to PRs from branches of thearduino/arduino-cli repository. The same intermittent spurious workflow run failures will continue to occur for PRs from forks (such as this PR).

For example, check the workflow run logs for this PR:
https://github.com/arduino/arduino-cli/actions/runs/4534782144/jobs/7989648996?pr=2129#step:7:27

[2023-03-27T17:36:03.699Z] ['info'] -> No token specified or token is empty

The alternative solution would be to add the token in plaintext directly in the workflow. The security implications of that approach are described here:

https://community.codecov.com/t/upload-issues-unable-to-locate-build-via-github-actions-api/3954

Public repositories that rely on PRs via forks will find that they cannot effectively use Codecov if the token is stored as a GitHub secret. The scope of the Codecov token is only to confirm that the coverage uploaded comes from a specific repository, not to pull down source code or make any code changes.

For this reason, we recommend that teams with public repositories that rely on PRs via forks consider the security ramifications of making the Codecov token available as opposed to being in a secret.

A malicious actor would be able to upload incorrect or misleading coverage reports to a specific repository if they have access to your upload token, but would not be able to pull down source code or make any code changes.

Working as intended now:

https://github.com/arduino/arduino-cli/actions/runs/4551550129/jobs/8026020631#step:8:29

[2023-03-29T08:05:58.070Z] ['info'] ->  Token found by environment variables

Thanks Cristian!