Bump codecov/codecov-action from 4 to 5 #56
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 5. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4...v5) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
the
dependencies
|
The main issue with this is how it handles tokenless uploads (for public projects). All our uploads are tokenless as we only allow upload to codecov for public projects (we'd need to be on a paid plan to upload internal projects). Their docs suggest it just requires an |
I've been meaning to look into this for a while @brynpickering. (I think) I see the CodeCov upload failing even on public repos like PAM and GeNet, where tokenless upload should work; plus, I remember seeing a CodeCov token in the secrets on some of our repos. This is from a GeNet build kicked off by a PR: Every command the action attempts seems to fail because of a token/branch protection problem, so presumably the upload to CodeCov is falling? And yet the action looks like it succeeded. Where should the coverage reports be uploaded to? How do I check them from that side?
I'm an admin on the organisation, so I should be able to do that. Let me check. |
|
I've changed the global setting on the arup-group organisation @brynpickering: 
|
Yeah, tokenless uploads have been a pain in <v5 as it was technically possible but would often fail (this is why I added the codecov token where possible). I also hadn't realised they'd added this "if not protected" rule. If you checking this box is sufficient for them all to work in v5 then we can update the action to fail when codecov fails. |
|
That looks to have done the trick, @brynpickering. I manually re-ran a GeNet build that had previously failed to upload to CodeCov, and it's pushed the report (see here). So we're now okay to merge this PR? |
|
I'm wondering if the CodeCov token is being passed to the I think we would need to include a aws-upload:
needs: test
if: needs.test.result == 'success'
uses: arup-group/actions-city-modelling-lab/.github/workflows/aws-upload.yml@main
secrets:
AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
AWS_S3_CODE_BUCKET: ${{ secrets.AWS_S3_CODE_BUCKET }}I don't see the CODECOV_TOKEN secret being propagated in the same way in workflow steps like this one. Of course, this is no longer important if we stick with the no-token uploads approach across the board, but if we do need to use a token in places, we need to bear it in mind. |
dependabot
bot
deleted the
dependabot/github_actions/codecov/codecov-action-5
branch
Bumps codecov/codecov-action from 4 to 5.
Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
5c47607fix: override commit and pr values for PR cases (#1657)3b1354achore(release): 5.0.1 (#1656)2e2a9c6fix: update tokenless branch logic (#1650)cfc521bUpdate README.md0642541fix: use marketplace v5 badge (#1646)9688725Update README.md2112eaechore(deps): bump wrapper to 0.0.23 (#1644)193421cfixL use the correct source (#1642)6018df7fix: update container builds (#1640)eff1a64fix: add missing vars (#1638)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)