Recent updates to zizmor have flagged my use of secrets.CODECOV_TOKEN as a rule violation (see secrets-outside-env). The remedy is to isolate any job that uses a secret to a protected environment.
This got me thinking. Github Actions environments support a URL that can be displayed on job success (see github docs). For a visual example:
So, if this action had an output of the URL that pointed to the corresponding project on app.codecov.io, that would be another way (beside a README badge) of navigating to the codecov project from github.com