chore(deps): update codecov/codecov-action action to v7 - #36
chore(deps): update codecov/codecov-action action to v7#36renovate[bot] wants to merge 1 commit into
Conversation
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe CI workflow is updated to use Codecov GitHub Actions v7 instead of v6, upgrading the coverage upload step to the latest action version. ChangesCodecov action upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #36 +/- ##
=======================================
Coverage 86.11% 86.11%
=======================================
Files 1 1
Lines 360 360
=======================================
Hits 310 310
Misses 30 30
Partials 20 20 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 48: Update the Codecov action ref used in the GitHub Actions workflow:
replace the invalid floating tag "codecov/codecov-action@v7" with the immutable
commit SHA for v6.0.0 by changing the uses value to
"codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"; ensure the
change occurs in the workflow step that currently contains the uses entry so CI
uses the pinned, valid release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6378ea90-d665-46b7-8315-bc585909a9a6
📒 Files selected for processing (1)
.github/workflows/ci.yml
|
|
||
| - name: Upload coverage reports to Codecov | ||
| uses: codecov/codecov-action@v6 | ||
| uses: codecov/codecov-action@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced line
ls -la .github/workflows || true
nl -ba .github/workflows/ci.yml | sed -n '1,120p'Repository: ALRubinger/aileron-connector-google
Length of output: 368
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Print lines 35-65 with line numbers using awk (since nl isn't available)
awk 'NR>=35 && NR<=65 {printf "%d:%s\n", NR, $0}' .github/workflows/ci.ymlRepository: ALRubinger/aileron-connector-google
Length of output: 941
🌐 Web query:
codecov/codecov-action v7 commit SHA
💡 Result:
As of June 7, 2026, there is no official v7 release of the codecov/codecov-action [1]. The most recent major release for this action is v6 (specifically, v6.0.1 is cited in recent documentation and release history) [2][3][4]. References to "v7" in some community configurations or discussions often stem from confusion with other GitHub actions (such as actions/github-script or actions/upload-artifact, which have reached v7) [5][6][7] or mistaken versioning expectations [1]. Because a v7 tag for codecov/codecov-action does not exist, there is no corresponding commit SHA for it. To ensure your GitHub Actions workflow remains stable and secure, it is recommended to use the latest established stable version (e.g., v6.0.1) or pin to a specific, verified commit SHA from the official repository's releases [2].
Citations:
- 1: cuihairu/croupier@c306bad
- 2: https://github.com/codecov/codecov-action/releases
- 3: https://github.com/codecov/codecov-action/tree/refs/heads/main
- 4: https://github.com/marketplace/actions/codecov
- 5: codecov/codecov-action@39a2af1
- 6: build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.0 codecov/codecov-action#1924
- 7: build(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 codecov/codecov-action#1935
🌐 Web query:
site:github.com codecov/codecov-action refs/tags v7
💡 Result:
There is no tag v7 in codecov/codecov-action as of the sources found: the action repository documents and exposes release tags up through v6 (e.g., refs/tags/v6 and v6.0.0) and does not list a v7 tag in the provided authoritative repository pages [1][2]. So the GitHub Action reference codecov/codecov-action@refs/tags/v7 would not resolve to a valid tag in this repository based on these sources; the highest tag shown is v6.0.0 under refs/tags/v6.0.0 [1]. For using the action in workflows, the repository README recommends using a major tag like @v5 and shows the uses: codecov/codecov-action@v5 pattern; the tag selection should therefore be updated to an existing major version such as @v6 if you want the latest supported major tag shown in the repo sources [3].
Citations:
- 1: https://github.com/codecov/codecov-action/tree/refs/tags/v6.0.0
- 2: https://github.com/codecov/codecov-action/tree/refs/tags/v6
- 3: https://github.com/codecov/codecov-action/blob/main/README.md
🌐 Web query:
site:github.com codecov/codecov-action v7 refs/heads
💡 Result:
There is no “codecov/codecov-action v7”. The Codecov GitHub Action repository shows releases up through v6 (e.g., “v6.0.0 Latest … Mar 26, 2026”) rather than v7.[1][2] So a reference like “codecov/codecov-action@v7” (or “codecov/codecov-action v7 refs/heads …”) is not a valid version tag, and you should use an existing major tag (such as @v6) or pin to a specific commit/branch ref.[1][3] If your goal is to use the action with a branch ref, GitHub supports “owner/repo@” syntax (e.g., @main or @refs/heads/), and the repository is reachable at those refs (example path shown for refs/heads/main).[4] Example (use an existing release tag): - uses: codecov/codecov-action@v6 Example (use a branch ref): - uses: codecov/codecov-action@refs/heads/main Codecov action configuration inputs include (at least) fail_ci_if_error and token, as described in the action README and action.yml.[3][5]
Citations:
- 1: https://github.com/codecov/codecov-action
- 2: https://github.com/codecov/codecov-action/tree/refs/tags/v6.0.0
- 3: https://github.com/codecov/codecov-action/blob/main/README.md
- 4: https://github.com/codecov/codecov-action/tree/refs/heads/main
- 5: https://github.com/codecov/codecov-action/blob/master/action.yml
🌐 Web query:
codecov/codecov-action v6.0.0 commit SHA
💡 Result:
The commit SHA associated with the v6.0.0 release of codecov/codecov-action is 57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 [1]. This version was released on March 26, 2026 [2][3].
Citations:
- 1: codecov/codecov-action@57e3a13
- 2: https://github.com/codecov/codecov-action/releases/tag/v6.0.0
- 3: https://github.com/codecov/codecov-action/tree/refs/tags/v6.0.0
Fix the Codecov step ref and pin it to an immutable commit SHA.
Line 48 uses codecov/codecov-action@v7, but the Codecov action repository only provides releases up to v6 (so @v7 is not a valid version ref). Update the step to pin v6.0.0 instead: uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 48, Update the Codecov action ref used in
the GitHub Actions workflow: replace the invalid floating tag
"codecov/codecov-action@v7" with the immutable commit SHA for v6.0.0 by changing
the uses value to
"codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"; ensure the
change occurs in the workflow step that currently contains the uses entry so CI
uses the pinned, valid release.
Source: Linters/SAST tools
7e5c867 to
ef83a2b
Compare
ef83a2b to
529b601
Compare
This PR contains the following updates:
v6→v7Release Notes
codecov/codecov-action (codecov/codecov-action)
v7.0.0Compare Source
codecovsecurityaccount. We have deleted the account and are usingcodecovsecopswith the original gpg keyWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0
v7Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.