codecov.io now wants a token

[flying-sheep]

the coverage job should therefore look like this:

- name: Upload coverage data
  if: ${{ !cancelled() }}
  uses: codecov/codecov-action@v5
  with:
    token: ${{ secrets.CODECOV_TOKEN }}
    fail_ci_if_error: true

• if: ${{ !cancelled() }} (maybe) to upload coverage even when tests fail.
• fail_ci_if_error: true to prevent that step from silently not working

and we should mention to (how to) add the CODECOV_TOKEN secret if we don’t already.

[grst]

How does this work if someone makes a PR from a fork?
Actions running from a fork won't have access to repository secrets.

[grst]

ah, so this is only for the main branch?

https://docs.codecov.com/docs/codecov-tokens#uploading-without-a-token

[flying-sheep]

Or unless

the organization has disabled token authentication for public repositories

e.g. I see

So we could also instruct users to disable token auth instead, but they seem to want people to use tokens. What do you think?

[grst]

I also think there must be a reason they start asking for it.

According to the codecov action, there's also OIDC support: https://github.com/codecov/codecov-action?tab=readme-ov-file#using-oidc

Wouldn't that be the preferable solution anyway?

[flying-sheep]

ooo I didn’t know! Does it work for forks? If so, this is of course much better, as it’s zero-config

/edit: seems like that works, wonderful! There’s an issue that says that it’s broken, and they fixed it, implying that it’s supposed to work codecov/codecov-action#1821

[mumichae]

Hi @grst @flying-sheep this update tripped me up a bit. I had to change the global token settings in my CodeCov account to "Not required". Although the "Required" option seems to only be there for legacy reasons, I can imagine some people might have good reason to keep it. Might be good to document this somewhere.

[grst]

Wait, so OIDC works only if you set that setting in CodeCov to "not required"?

[mumichae]

That's what I had to do to get it to work. I didn't figure out if there's a way to do this on a project basis, but it might work by editing a Yaml (instead of clicking a toggle)