fix: improve codecov upload token handling and add guard condition

- Add condition to only run on main repo when token is available
- Move CODECOV_TOKEN from env to with.token parameter (preferred by codecov-action v5)
- Prevents issues with fork PRs where secrets are unavailable

Addresses Copilot feedback validated by @edeandrea in PR docling-project#406

Co-authored-by: Bob <bob@codeium.com>
Signed-off-by: Rohan <rohan.kurian@ibm.com>

Author: Rohan

.github/workflows/build.yml

@@ -108,14 +108,14 @@ jobs:
         run: ./gradlew --no-daemon -Pjava.version=${{ matrix.java }} :test-report-aggregation:check
 
       - name: Upload coverage to Codecov
+        if: ${{ github.repository == 'docling-project/docling-java' && secrets.CODECOV_TOKEN != '' }}
         uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           files: ./test-report-aggregation/build/reports/jacoco/testCodeCoverageReport/testCodeCoverageReport.xml
           flags: java${{ matrix.java }}
           name: codecov-java${{ matrix.java }}
           fail_ci_if_error: false
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }}
 
       - name: Prepare build reports
         if: always()