Passing secrets.CODECOV_TOKEN not recognized

[CasperWA]

Having set up the secret CODECOV_TOKEN and passing it as ${{ secrets.CODECOV_TOKEN }} the upload fails with the message:

HTTP 400
Please provide the repository token to upload reports via `-t :repository-token`

This is both for v1 and v1.0.5 of codecov-action.

It seems that the action's environment variable CODECOV_TOKEN is not set properly or not recognized?

It should be mentioned that this has recently started failing, without changing the actions workflow otherwise, i.e., it used to work, but now throws this error.

[CasperWA]

Is it the case that this may fail if the secret is set for the main owner, but not a fork, during a PR from the fork to the main owner (upstream repo)?

[CasperWA]

So it seems the reason for this is a lack of support for token-less uploads to codecov for Github Actions. Something that seemingly exists for other CI services, e.g., Travis.

If you do not consider this an issue of this repo, which is fair, then please close this issue.
I do think, however that it is worth mentioning this in the README, clarifying that if one wants to upload using a GitHub secret, then one needs to have the secret in the (forked) repository that contains the branch, since these are the ones running the Actions - even for PRs to an upstream branch.
At the moment this information is not easily gleened, and it is not likely that this behaviour will (or should) change for GitHub Actions, since it could allow for security risks, e.g., exposing other owner's secrets.

I hope codecov will implement a token-free, secure upload mechanism for GH Actions soon.

[ibrahim0814]

Hi @CasperWA, thanks for bringing this up! You're right, secrets are not available for forks of repositories, therefore the token wasn't available when you tried to upload to Codecov from the forked repository. I'll push an update to our readme soon because it's definitely worth clarifying

With regards to tokenless uploads, we do plan to support them when GitHub releases an API for Actions around early 2020.

[ibrahim0814]

@CasperWA I've added a notice for this issue in here and will now close this thread

[frgfm]

Hi @ibrahim0814,

Are we positive this issue is actually solved? I first thought it was just a one-day server issue but I'm consistently getting this error on coverage upload for my public repos (latest error being https://github.com/frgfm/Holocron/pull/79/checks?check_run_id=1102442559).

I haven't changed my coverage report generation and upload job for months, it just started throwing errors at some point. But maybe I did something wrong?

Any input would be appreciated!

[thomasrockhu]

@frgfm please upgrade to the latest version of the action and let me know if that doesn't work.

[frgfm]

@thomasrockhu Oh thanks! Reading about the issue earlier in other discussions, switching to the latest version didn't seem to help them. But apparently I should have tried it out, because it works!