From e19a8d722b429548544a3b6d28f5e8dd3b5a0e32 Mon Sep 17 00:00:00 2001 From: Leonidas Vrachnis Date: Sun, 18 Oct 2026 11:30:53 +0200 Subject: [PATCH] chore(ci): move codecov-action to v7.1.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codecov deleted the codecovsecurity Keybase account. Action versions v5.0.0 to v6.0.1 still download the signing key from it, get a 404, and skip the signature check on the Codecov CLI. v7.1.1 reads the same key from codecovsecops. Verify: the Codecov step log shows "Good signature" and the upload completes. Co-Authored-By: Claude Opus 5.5 🔒 Scanned for secrets using gitleaks 8.30.1 --- .github/workflows/lint-test.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint-test.yaml b/.github/workflows/lint-test.yaml index b4cd2c97..8c1120c6 100644 --- a/.github/workflows/lint-test.yaml +++ b/.github/workflows/lint-test.yaml @@ -187,7 +187,7 @@ jobs: test/package-lock.json - run: SKIP_SUBMODULE_DEPS=1 npm ci - run: npm run test:unit - - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1 if: success() with: token: ${{ secrets.CODECOV_TOKEN }}