Repository navigation
ci: upload coverage to codecov via oidc - #456
Merged
Merged
Conversation
Codecov rejects tokenless uploads to protected master ("Token required because branch is protected"), so the last master report is c8311da from 2024-06 and every PR is compared against it. fail_ci_if_error stays false.
Signed-off-by: Henry Sachs <henry.sachs@deutschebahn.com>
dariozachow
approved these changes
Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of your changes
Codecov compares every PR against
c8311da(2024-06-12, 207 commits behind master), e.g. #414:53.83% (-5.20%) compared to c8311da.Cause: master uploads fail. From the unit-tests log of master
36d9ccf:The repo has no
CODECOV_TOKENsecret, and the job stays green becausefail_ci_if_errordefaults tofalse. PR uploads work tokenless, master pushes don't.This switches the upload to OIDC (
use_oidc,id-token: writeonunit-tests), so no secret is needed. Fork PRs get no OIDC token and keep the tokenless upload.fail_ci_if_errorstaysfalseon purpose: a Codecov outage should not block CI.After the merge, the first master push should give Codecov a current base. Open PRs are compared correctly after their next CI run.
I have:
make reviewable testto ensure this PR is ready for review. Not needed, only the workflow changes.How has this code been tested
actionlintv1.7.7 passes onci.yaml.use_oidcandfail_ci_if_errorchecked againstaction.ymlof the pinned action SHA (v7.1.1).unit-testslog of the first master run after merge forUpload queued for processing completewithout an error.