[Jeff Mendoza (jeffmendoza)]

Upgrade SHA-pinned codecov/codecov-action from v5.5.2 to v7.1.1. The old composite action invokes actions/github-script v7 on Node 20; the new release invokes v8 on Node 24. The existing CODECOV_TOKEN configuration is unchanged.

All other pinned JavaScript actions already use Node 24. This .NET repository has no custom Azure Pipelines task or non-fixture npm project, so the handler, minimum agent version, and npm dependency changes in the Node 24 migration guide do not apply. Detection fixtures and historical examples remain unchanged.

Validation:

• git diff --check — passed.
• PowerShell recursive audit of all 18 direct/transitive pinned action manifests — passed; every JavaScript action uses Node 24, and Codecov retains env.CODECOV_TOKEN support.
• Actual GitHub workflow and coverage upload — not run locally; require CI.
• .NET tests — not run; no .NET code or fixtures changed.

New Detector Checklist

Not applicable: this change does not add a detector.

• I have gone through the docs for creating a new detector here
• My new detector implements IDefaultOffComponentDetector
• I have created a PR to the verification repo with components that my new detector can find
• (If necessary) I have updated the Feature Overview table in the README

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Codecov action update.

No open issues 🎉

What changed in this PR

Updates the build workflow’s Codecov action to use Node 24 while preserving the existing coverage upload token configuration.

Changes:

• Upgrades SHA-pinned codecov/codecov-action from v5.5.2 to v7.1.1.
• Leaves .NET code, detection fixtures, and other workflow settings unchanged.

File	Description
.github/​workflows/​build.yml	Updates the Codecov action pin for Node 24 support.

_{Review effort: Balanced}