Larry Hastings (Python 3.5 release manager) failed to merge my security fix into Python 3.5. The Codecov job run on the PR, failed and it must pass to merge a PR if I understood correctly Larry:
https://github.com/python/cpython/pull/17344#issuecomment-605417483

The same job also ran and failed on another security fix for Python 3.6:
https://github.com/python/cpython/pull/19304

I propose to copy .github/codecov.yml configuration from master to 3.5 and 3.6 branches to disable the Codecov "patch" job.

See also recent issue: bpo-39704 "Disable code coverage". Codecov should no longer post comments with the result of the code coverage analysis: it's disabled for the whole Python organization.

There are no longer "Codecov patch" jobs on the 3.7, 3.8 and master branches.