Upgrade codecov action to v7

[gaiksaya]

Description

Bumping the code coverage action to v7 to see if it fixes the below action:

[2026-07-31T21:39:57.930Z] ['error'] There was an error running the uploader: Error uploading to [https://codecov.io:](https://codecov.io/) Error: There was an error fetching the storage URL during POST: 429 - {"message":"Rate limit reached. Please upload with the Codecov repository upload token to resolve issue. Expected time to availability: 2556s."}

Related Issues

https://github.com/opensearch-project/custom-codecs/actions/runs/30666851118/job/91276258302?pr=361

Check List

• New functionality includes testing.
• New functionality has been documented.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit c84e9a4.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
.github/workflows/check.yml	38	high	GitHub Actions dependency changed: codecov/codecov-action pinned hash updated from ab904c41d6ece82784817410c45d8b8c02684457 (v3) to fb8b3582c8e4def4969c97caa2f19720cb33a72f (v7). This is a significant version jump (v3 → v7). The codecov action has a known supply chain attack history (2021 incident). The new commit hash cannot be verified as authentic without checking against the official codecov/codecov-action repository. Maintainers must verify this hash corresponds to the legitimate v7 release tag on the official repository before merging.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.