ci: check sha512 of downloaded codecov script

PostgREST · Apr 16, 2021 · 1f206a5 · 1f206a5
1 parent 42f8f4f
commit 1f206a5
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -176,7 +176,13 @@ jobs:
           when: on_fail
       - run:
           name: Upload coverage to codecov
-          command: bash <(curl -s https://codecov.io/bash) -f coverage/codecov.json
+          command: |
+            # Modified from:
+            # https://docs.codecov.io/docs/about-the-codecov-bash-uploader#validating-the-bash-script
+            curl -s https://codecov.io/bash > codecov;
+            VERSION=$(grep 'VERSION=\".*\"' codecov | cut -d'"' -f2);
+            shasum -a 512 -c <(curl -s https://raw.githubusercontent.com/codecov/codecov-bash/${VERSION}/SHA512SUM | grep codecov)
+            bash codecov -f coverage/codecov.json
       - run:
           name: Run the spec tests against PostgreSQL 12
           command: postgrest-with-postgresql-12 postgrest-test-spec