[BUG] Tokenless upload rejected for a public fork PR #1978

Describe the bug

The Codecov upload for public fork PR #189 in jsoizo/kotlin-csv failed with:

HTTP 400: Token required - not valid tokenless upload

The original GitHub Actions job uses codecov/codecov-action@v4 and CLI
11.3.2. It detects the fork and supplies a colon-prefixed branch.
Authenticated main uploads succeed.

The cause is not established. An earlier version of this report emphasized
repository synchronization too strongly; that is only an unconfirmed
possibility based on similar reports.

Observed failure

PR: jsoizo/kotlin-csv#189

Failing job:
https://github.com/jsoizo/kotlin-csv/actions/runs/41361427049/job/128587373730

Metadata in the original job:

• Repository slug: jsoizo/kotlin-csv
• Branch: Alox1d:bugfix/utf8-surrogate-pairs
• Commit: d0029f4f349c2c00b0272e4a1a105da30a926179
• Pull request: 189
• Git service: github

Additional investigation and limits

Local CLI 11.3.2 replays with this metadata also returned HTTP 400 for
create-commit and upload-coverage. The latter used a real Kover report
generated from the exact commit after all 258 JVM tests passed.

These were local CLI runs, not a validation of the current v7 Action in a
GitHub fork PR. We have not established whether upgrading the Action fixes
the original workflow.

The Codecov public API reports private: false, active: true,
activated: true, and author jsoizo:

https://api.codecov.io/api/v2/github/jsoizo/repos/kotlin-csv/

Successful authenticated main run:
https://github.com/jsoizo/kotlin-csv/actions/runs/42434464353

The repository was previously doyaaaaaken/kotlin-csv, with GitHub repository
ID 200859123. We do not know whether the ownership change is relevant.

Expected behavior

Coverage uploads from public fork PRs succeed without exposing the upstream
repository token.

Environment

• Git host: GitHub
• CI: GitHub Actions
• Original runner: Ubuntu 24.04
• Action in the failing job: codecov/codecov-action@v4
• CLI: 11.3.2

What would you recommend checking to distinguish a client/workflow issue
from a Codecov-side authentication or repository synchronization issue?

Repository tracking issue:
jsoizo/kotlin-csv#193