Bump the actions group with 4 updates

.github/workflows/test_and_publish.yml

@@ -21,7 +21,9 @@ concurrency:
 
 jobs:
   test:
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v2
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/tox.yml@v3
+    permissions:
+      id-token: write
     with:
       libraries: |
         apt:
@@ -48,12 +50,12 @@ jobs:
         - linux: py310-test-mpl35
         - macos: py310-test-mpl35
         - windows: py310-test-mpl35
-      coverage: 'codecov'
+      coverage: 'codecov-oidc'
 
   publish:
     if: github.event_name != 'pull_request'
     needs: [test]
-    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@v2
+    uses: OpenAstronomy/github-actions-workflows/.github/workflows/publish_pure_python.yml@v3
     with:
       test_command: pytest $GITHUB_WORKSPACE/tests; pytest --mpl $GITHUB_WORKSPACE/tests
     secrets:

.github/workflows/update-changelog.yaml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           ref: main
           persist-credentials: true
@@ -29,7 +29,7 @@ jobs:
           path-to-changelog: CHANGES.md
 
       - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v4
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v4
         with:
           branch: main
           commit_message: Update CHANGELOG

tox.ini

@@ -14,6 +14,7 @@ passenv =
     WINDIR
     MPL_UPDATE_*
 setenv =
+    COVERAGE_FILE = {toxinidir}/.coverage
     MPLBACKEND = Agg
     mpldev: PIP_EXTRA_INDEX_URL = https://pypi.anaconda.org/scientific-python-nightly-wheels/simple
 changedir = .tmp/{envname}