Skip to content

chore(deps): update codecov/codecov-action action to v7 #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update codecov/codecov-action action to v7 #36

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ jobs:
run: task test:unit

- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@v6
uses: codecov/codecov-action@v7

@coderabbitai coderabbitai Bot Jun 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced line
ls -la .github/workflows || true
nl -ba .github/workflows/ci.yml | sed -n '1,120p'

Repository: ALRubinger/aileron-connector-google

Length of output: 368

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Print lines 35-65 with line numbers using awk (since nl isn't available)
awk 'NR>=35 && NR<=65 {printf "%d:%s\n", NR, $0}' .github/workflows/ci.yml

Repository: ALRubinger/aileron-connector-google

Length of output: 941

🌐 Web query:

codecov/codecov-action v7 commit SHA

💡 Result:

As of June 7, 2026, there is no official v7 release of the codecov/codecov-action [1]. The most recent major release for this action is v6 (specifically, v6.0.1 is cited in recent documentation and release history) [2][3][4]. References to "v7" in some community configurations or discussions often stem from confusion with other GitHub actions (such as actions/github-script or actions/upload-artifact, which have reached v7) [5][6][7] or mistaken versioning expectations [1]. Because a v7 tag for codecov/codecov-action does not exist, there is no corresponding commit SHA for it. To ensure your GitHub Actions workflow remains stable and secure, it is recommended to use the latest established stable version (e.g., v6.0.1) or pin to a specific, verified commit SHA from the official repository's releases [2].

Citations:

🌐 Web query:

site:github.com codecov/codecov-action refs/tags v7

💡 Result:

There is no tag v7 in codecov/codecov-action as of the sources found: the action repository documents and exposes release tags up through v6 (e.g., refs/tags/v6 and v6.0.0) and does not list a v7 tag in the provided authoritative repository pages [1][2]. So the GitHub Action reference codecov/codecov-action@refs/tags/v7 would not resolve to a valid tag in this repository based on these sources; the highest tag shown is v6.0.0 under refs/tags/v6.0.0 [1]. For using the action in workflows, the repository README recommends using a major tag like @v5 and shows the uses: codecov/codecov-action@v5 pattern; the tag selection should therefore be updated to an existing major version such as @v6 if you want the latest supported major tag shown in the repo sources [3].

Citations:

🌐 Web query:

site:github.com codecov/codecov-action v7 refs/heads

💡 Result:

There is no “codecov/codecov-action v7”. The Codecov GitHub Action repository shows releases up through v6 (e.g., “v6.0.0 Latest … Mar 26, 2026”) rather than v7.[1][2] So a reference like “codecov/codecov-action@v7” (or “codecov/codecov-action v7 refs/heads …”) is not a valid version tag, and you should use an existing major tag (such as @v6) or pin to a specific commit/branch ref.[1][3] If your goal is to use the action with a branch ref, GitHub supports “owner/repo@” syntax (e.g., @main or @refs/heads/), and the repository is reachable at those refs (example path shown for refs/heads/main).[4] Example (use an existing release tag): - uses: codecov/codecov-action@v6 Example (use a branch ref): - uses: codecov/codecov-action@refs/heads/main Codecov action configuration inputs include (at least) fail_ci_if_error and token, as described in the action README and action.yml.[3][5]

Citations:

🌐 Web query:

codecov/codecov-action v6.0.0 commit SHA

💡 Result:

The commit SHA associated with the v6.0.0 release of codecov/codecov-action is 57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 [1]. This version was released on March 26, 2026 [2][3].

Citations:

Fix the Codecov step ref and pin it to an immutable commit SHA.

Line 48 uses codecov/codecov-action@v7, but the Codecov action repository only provides releases up to v6 (so @v7 is not a valid version ref). Update the step to pin v6.0.0 instead: uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2.

🧰 Tools
🪛 zizmor (1.25.2)

[error] 48-48: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 48, Update the Codecov action ref used in
the GitHub Actions workflow: replace the invalid floating tag
"codecov/codecov-action@v7" with the immutable commit SHA for v6.0.0 by changing
the uses value to
"codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2"; ensure the
change occurs in the workflow step that currently contains the uses entry so CI
uses the pinned, valid release.

Source: Linters/SAST tools

with:
token: ${{ secrets.CODECOV_TOKEN }}
slug: ALRubinger/aileron-connector-google
Expand Down
Loading