This overwrites the `codecov.yml` file in the root of the repository with `codecov-upstream.yml` file (which contains the code-cov token)´, so PRs and branches on the repository can upload coverage. Suggestion from here: https://github.com/pytest-dev/pytest/pull/6421#issuecomment-571934112 Security concerns: the token might be misused, but only to upload bogus coverage to `codecov.io`, so the team believe this is harmless. If we decide to fallback from this decision , we just need to revoke the token. Related to #6369