ci: relocate Codecov config, pin actions, add concurrency

[thc1006]

Hardens and fixes the GitHub Actions setup (CI-config only, no source changes).

• Relocate the misplaced Codecov config. .github/workflows/codecov.yml is a Codecov configuration file (it has no on:/jobs:), so Actions treats it as an invalid workflow and records a failed run on every commit. Moved to .github/codecov.yml (content unchanged). The real reusable workflow upload-to-codecov.yml correctly stays under workflows/.
• Pin third-party actions off the moving @main/@master refs to current stable tags: checkout@v7, setup-python@v6, upload-artifact@v7, download-artifact@v8, codecov-action@v7, auto-assign@v3, gh-action-pypi-publish@v1.14.0 (supply-chain / stability hygiene).
• Add concurrency cancel-in-progress to the PR-triggered Tests and Linters workflows so superseded runs are cancelled (deliberately not added to the scheduled slow workflow).
• Pin ruff (ruff==0.15.20) in the lint workflow for reproducible results.

Note: master carries the same misplaced codecov.yml; a release or cherry-pick clears the permanent failure there too.

[zuorenchen]

Do you want to send this PR to RocketPy directly? We can then pull from RocketPy

[thc1006]

Do you want to send this PR to RocketPy directly? We can then pull from RocketPy

For sure and I will also submit the fixes for the other accelerated optimization issues. I am currently running benchmarks and tests.

[thc1006]

Yes, upstream first makes more sense than landing it here. Most of what this touches is inherited from RocketPy unchanged, so fixing it here just gives the next sync something to reconcile.

Two things before it goes anywhere, though. I went back over the current CI while checking a review of this branch, and the parts this PR reorganises are not merely untidy, they are reporting success without doing the work. Written up with log evidence in #22:

• the Codecov upload fails on every run (Token length: 0, then Token required - not valid tokenless upload) and the job still passes, because fail_ci_if_error is false. The files: block literal also passes the filename with a trailing newline, so the named path is never found and the uploader silently falls back to searching.
• all six matrix legs upload under the artifact name coverage with overwrite: true, so five results are discarded and whichever leg finishes last becomes the whole report.

The token part is specific to this repository and cannot be fixed upstream. The artifact race and the files: newline are inherited and belong there.

So I would rather split this: send the genuinely upstream parts to RocketPy, and keep a small ARP-only change for the token and anything else fork-specific. This branch is also four commits behind develop now and its green checks are from 2026-06-27, so it needs a rebase and a fresh run before it means anything either way.

Happy to close this one and open the two replacements, or to rework it in place, whichever you prefer.

[thc1006]

Marking this draft rather than pushing more to it, for the reason you raised: most of what it touches is inherited from RocketPy, so fixing it here gives the next sync something to reconcile. It is also no longer mergeable against develop, conflicting in both test workflows against the headless-display steps that landed there.

What I verified in the meantime, on run 30401988315, is that two of these are not untidiness but jobs reporting success while doing nothing. Written up with the log lines in #22: the Codecov upload fails on every run (Token length: 0, then Token required - not valid tokenless upload) and passes because fail_ci_if_error is false, and all six matrix legs upload under the artifact name coverage with overwrite: true, so the run keeps one report and discards five.

The split I plan, unless you would rather sequence it differently:

• Upstream to RocketPy: the artifact race, the files: block literal that passes the filename with a trailing newline, the auto-assign action that does not support the config input it is given, the incomplete reusable Codecov workflow, and pinning actions to commit SHAs. All of these exist upstream in the same shape.
• Here, small and separate: the Codecov credential or OIDC setup, which is specific to this repository and cannot be fixed upstream. That one closes Coverage upload reports success without uploading, and five of six coverage reports are discarded #22.

I will reopen this or replace it once the upstream side is in, so there is nothing to review here in the meantime.