ci: fix lint cache key and codecov upload on dependabot PRs

.github/workflows/lint.yaml

@@ -24,19 +24,27 @@ jobs:
       - name: Install pre-commit
         run: uv sync -U --group lint
 
+      # Hook environments in the pre-commit cache are virtualenvs tied to one
+      # CPython patch release, so the cache key and its restore-keys prefix carry
+      # the resolved patch version. Keying only on "3.13" means a runner that has
+      # moved to a newer patch release restores environments it has to discard
+      # and rebuild.
+      - name: Resolve the Python patch version used for cache keys
+        run: echo "PYTHON_PATCH_VERSION=$(uv run python -c 'import platform; print(platform.python_version())')" >> "$GITHUB_ENV"
+
       - uses: actions/cache@v4
         with:
           path: .mypy_cache
-          key: ${{ runner.os }}-mypy-${{ hashFiles('pyproject.toml') }}
+          key: ${{ runner.os }}-py${{ env.PYTHON_PATCH_VERSION }}-mypy-${{ hashFiles('pyproject.toml') }}
           restore-keys: |
-            ${{ runner.os }}-mypy-
+            ${{ runner.os }}-py${{ env.PYTHON_PATCH_VERSION }}-mypy-
 
       - uses: actions/cache@v4
         with:
           path: ~/.cache/pre-commit
-          key: ${{ runner.os }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+          key: ${{ runner.os }}-py${{ env.PYTHON_PATCH_VERSION }}-pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
           restore-keys: |
-            ${{ runner.os }}-pre-commit-
+            ${{ runner.os }}-py${{ env.PYTHON_PATCH_VERSION }}-pre-commit-
 
       - name: pre-commit
         run: uv run pre-commit run --all-files --verbose

.github/workflows/tests-unit.yaml

@@ -20,6 +20,11 @@ jobs:
   run-unit-tests:
     timeout-minutes: 30
 
+    # Dependabot branches and forks do not receive repository secrets, so this is
+    # empty there and the Codecov upload is skipped rather than failing the job.
+    env:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
     strategy:
       fail-fast: false
       matrix:
@@ -42,7 +47,7 @@ jobs:
       - run: pytest tests/unit -v --cov --cov-report=xml
 
       - name: Upload coverage reports to Codecov
-        if: always()
+        if: always() && env.CODECOV_TOKEN != ''
         uses: codecov/codecov-action@v6
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ env.CODECOV_TOKEN }}

pyproject.toml

@@ -176,7 +176,7 @@ docs = [
 
 lint = [
   "pre-commit==4.5.1",
-  "pre-commit-uv==4.2.1",
+  "pre-commit-uv==4.3.0",
   "mypy",
   "types-requests",
   "types-pyyaml",