[BUG] Coverage fails to upload from fork

[bouweandela]

Describe the bug
A clear and concise description of what the bug is.

On pull requests from forks, coverage fails to upload with the error message: Token required because branch is protected

orb version: codecov/codecov@5.3.0

with arguments: https://github.com/ESMValGroup/ESMValCore/blob/62314887e3b722b1d20d42f9b7a39203a7706ceb/.circleci/config.yml#L146-L148

To Reproduce
Steps to reproduce the behavior:

1. Go to https://app.circleci.com/pipelines/github/ESMValGroup/ESMValCore/13423/workflows/9358d8bc-e8b6-4b0b-884b-d4da6aabaae6/jobs/55456
2. Click on 'Upload to Codecov'
3. Scroll down to the bottom
4. See error

Expected behavior
A clear and concise description of what you expected to happen.

I would expect the orb to upload coverage when it comes from a fork.

Regression
State whether this is a regression and when the last successful instance occurred

Screenshots
If applicable, add screenshots to help explain your problem.

    _____          _
    / ____|        | |
   | |     ___   __| | ___  ___ _____   __
   | |    / _ \ / _` |/ _ \/ __/ _ \ \ / /
   | |___| (_) | (_| |  __/ (_| (_) \ V /
    \_____\___/ \__,_|\___|\___\___/ \_/
                            Wrapper-0.2.2
                                  
==> Detected linux
 -> Downloading https://cli.codecov.io/latest/linux/codecov
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 10.6M  100 10.6M    0     0  69.8M      0 --:--:-- --:--:-- --:--:-- 69.7M
==> Finishing downloading linux:latest
      Version: v11.0.3
 
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM.sig
 
gpg: Signature made Thu May 29 21:23:31 2025 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
codecov: OK
==> CLI integrity verified

 -> Token length: 0
==> Running upload-coverage
      ./codecov  upload-coverage --disable-search --file test-reports/coverage.xml --report-type coverage
info - 2025-07-23 11:57:30,992 -- ci service found: circleci
warning - 2025-07-23 11:57:31,050 -- xcrun is not installed or can't be found.
warning - 2025-07-23 11:57:31,051 -- gcov is not installed or can't be found.
warning - 2025-07-23 11:57:31,051 -- coverage.py is not installed or can't be found.
info - 2025-07-23 11:57:31,105 -- Found 1 coverage files to report
info - 2025-07-23 11:57:31,105 -- > /root/project/test-reports/coverage.xml
info - 2025-07-23 11:57:31,376 -- Process Upload complete
error - 2025-07-23 11:57:31,376 -- Upload failed: {"message":"Token required because branch is protected"}

Product Area
If applicable, the product with the given bug (e.g. coverage, test analytics, browser extension, bundle analysis)

Versions

• OS: [e.g. linux, ubuntu@v24, macos arm64, windows]
• Git Host: [e.g. GitHub, GitLab, Bitbucket]
• CI/CD: [e.g. GitHub Actions, CircleCI]
• Uploader: [e.g. codecov-action@v5.3.1, codecov-circleci-orb@v5.2.0, codecov-cli@v10.0.1, uploader@v0.8.0]

Commit and CI link
Provide the commit SHA and CI link. If applicable, provide the entire Codecov output from CI.

Additional context
Add any other context about the problem here.

[linear]

CCMRG-1410 [BUG] Coverage fails to upload from fork