Repository navigation
Conversation
Codecov deleted the codecovsecurity Keybase account. Action versions v5.0.0 to v6.0.1 still download the signing key from it, get a 404, and skip the signature check on the Codecov CLI. v7.1.1 reads the same key from codecovsecops. Verify: the Codecov step log shows "Good signature" and the upload completes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> 🔒 Scanned for secrets using gitleaks 8.30.1
Contributor
Docker Preview Images ReadyPreview Docker images have been built for this PR: ECR (internal): docker pull 422074288268.dkr.ecr.us-east-1.amazonaws.com/rudderstack/profiles-code-server:pr-238Image Details:
Test the image: docker run --rm -p 8080:8080 422074288268.dkr.ecr.us-east-1.amazonaws.com/rudderstack/profiles-code-server:pr-238
|
There was a problem hiding this comment.
🟢 Approval recommended
The release pin and existing workflow compatibility were verified, with no unresolved findings.
No open issues 🎉
What changed in this PR
Updates the CI coverage uploader to Codecov v7.1.1 to restore signature verification using the updated signing-key location.
Changes:
- Updates the commit-pinned action from v5.5.1 to v7.1.1.
- Keeps existing step inputs unchanged.
| File | Description |
|---|---|
.github/workflows/lint-test.yaml |
Updates the Codecov action pin and version comment. |
Review effort: Balanced
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
codecov/codecov-actionmoves from v5.5.1 to v7.1.1, pinned to commit303a32d7a59b442fa8d48b6a1cc6825c09c847a5. No step input changes.Why
Codecov deleted the
codecovsecurityKeybase account and publishes the same signing key undercodecovsecops(v7.0.0 release note). Versions v5.0.0 to v6.0.1 still download the key from the old account and get a 404. The step then logsCould not verify signature, skips the signature check on the Codecov CLI, and uploads anyway. CI stays green, so nobody sees the skipped check.v6.0.0 moved the action to the node24 runtime. This workflow runs on GitHub-hosted Ubuntu runners, which support it.
How to verify
In the Codecov step log of this PR's run, look for
Good signatureandUpload queued for processing complete.Tracked in RUD-3372.
🤖 Generated with Claude Code