fix: skip the codecov upload when the run has no token - #17
Merged
Conversation
A Dependabot pull request runs without access to Actions secrets, so the upload token arrived empty and codecov refused a tokenless upload into a protected branch. With fail_ci_if_error the whole test job went red on every Python version while the suite itself passed, which is what both open dependency bumps were failing on. The token now reaches the step through the job environment, because a step if cannot read the secrets context, and the step is skipped when it is absent. Runs on main and on a branch in this repository upload exactly as before, and a pull request from a fork stops failing for the same reason. Nothing is lost on the skipped runs, since the coverage gate is the coverage report step that follows and it enforces the full hundred percent on its own.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both open Dependabot pull requests, #15 and #16, fail every
testjob while lint, typecheck, docs, build and audit pass.The suite itself is green there, 1147 passed and 4 skipped on each Python version.
What fails is the step after it.
A workflow run triggered by Dependabot gets no Actions secrets, so
secrets.CODECOV_TOKENresolves to an empty string, codecov declines a tokenless upload into a protected branch, andfail_ci_if_errorturns that into a red job.These are the first Dependabot pull requests the repository has had, so it had never come up.
The token now reaches the step through the job environment, because a step
ifcannot read the secrets context, and the upload is skipped when the token is absent.Runs on main and on a branch in this repository are unchanged and still upload under
fail_ci_if_error.A pull request from a fork stops failing for the same reason.
Nothing is lost on a skipped run.
The coverage gate is the
coverage reportstep that follows, andfail_under = 100enforces it there regardless of codecov, which only supplies the dashboard and the pull request comment.The documented alternative is adding the token as a Dependabot secret, which is what the codecov action recommends, and it would upload from those runs too.
It is not taken here because it hands an upload token to the one class of pull request that builds and executes third party code, and it does nothing for forks.
make auditis clean.🤖 Generated with Claude Code