fix: only run coverage upload if secret is available

.github/workflows/coverage.yaml

@@ -9,6 +9,8 @@ env:
 jobs:
   coverage:
     runs-on: ubuntu-latest
+    env:
+      COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
@@ -49,13 +51,13 @@ jobs:
           just coverage
 
       - name: Download Coveralls CLI
+        if: ${{ env.COVERALLS_REPO_TOKEN != '' }}
         run: |
           # use GitHub Releases URL instead of coveralls.io because they can't maintain their own files; it 404s
           curl -L https://github.com/coverallsapp/coverage-reporter/releases/download/v0.6.15/coveralls-linux-x86_64.tar.gz | tar -xz -C /usr/local/bin
 
       - name: Upload coverage to Coveralls
-        env:
-          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
+        if: ${{ env.COVERALLS_REPO_TOKEN != '' }}
         run: |
           if [ ! -f "lcov.info" ]; then
             echo "Error: lcov.info file not found. Coverage generation may have failed."