chore(deps): bump codecov/codecov-action from 4 to 7 - #81
Conversation
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 7. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4...v7) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
srpatcha
left a comment
srpatcha
left a comment
There was a problem hiding this comment.
Review — eDB#81 "chore(deps): bump codecov/codecov-action from 4 to 7"
head: ee5358c author: app/dependabot ci: the build/test workflow never ran — the only reported checks are Analyze (Python), CodeQL and assign, all pass
Verdict: The bump clears the v4→v5 rewrite without needing an edit, because ci.yml:60 already uses the plural files: that v5 renamed file: to, and flags: is unchanged across the range. It also picks up a real security fix (VULN-1652, template injection in run: steps, fixed in v6.0.1). So: correct as written. But CI — eDB did not run on this PR, the single line it changes is the last step of the job that never completes, and this repo has not had a green coverage upload since at least May — so the change is entirely unverified, and the step it touches has not executed in months.
Findings
| # | Severity | File:line | Finding | Recommended fix |
|---|---|---|---|---|
| 1 | High | .github/workflows/ci.yml (at base 5e436bd6), lines 6-7 |
CI — eDB never triggered on this PR, and its absence reads as success. At this PR's base commit 5e436bd63d53b14b5b75f5a0cc5e816642691388 the workflow carried pull_request: branches: [main], while the PR targets master — the trigger silently did not match. The Test (Python …) matrix is absent, not failing, so the overall green tick is composed entirely of CodeQL and assign. master has since been fixed (PR #70, 6d53641, now branches: [master, main]), but this PR branched before that. Same shape as the required_status_checks addendum of 2026-09-03 recorded for eDB#71/#72/#73; #80 and #81 share the same stale base. |
Rebase onto current master. Nothing else gives this PR evidence, and dependabot will not do it — see finding 3. Needs a human rebase and force-push to the dependabot branch, or close-and-reopen by hand. |
| 2 | High | .github/workflows/ci.yml:33, :58, matrix at :16-18 | The step this PR changes has not executed successfully in months, and would not have executed even if CI had run. codecov-action is the last step of the test job (:58). The job dies at :33 on pip install -r requirements.txt — no requirements.txt exists on master — so control never reaches :58. Run 33472965435 (master, 2026-09-01): six of nine matrix legs failure in 9-40s, three legs queued from 05:16:30Z to exactly 2026-09-02T05:16:30Z then cancelled, which is the 24h0m2s on the last three master runs. Every CI — eDB run since 2026-05 concluded failure. Whatever coverage badge eDB is publishing, no upload from this workflow is behind it. |
The requirements.txt half is already fixed in open PR #82 (autofix/ci-install-project-deps) — do not open a duplicate; land #82 first. The 24h queue starvation is not covered by #82: add timeout-minutes to the test job so a leg that cannot get a runner fails in minutes, not a day. |
| 3 | Medium | Repository state | Dependabot was removed from this repo after this PR was opened. .github/dependabot.yml does not exist on origin/master — deleted by #68, "chore(ci): remove Dependabot, add Claude + Copilot code review", merged 2026-09-01; this PR was opened 2026-08-31. Nothing will rebase it (finding 1), nothing will close it if superseded, and its own "The following labels could not be found: github-actions" comment is now permanently unactionable. Eleven dependabot PRs (#71-#81) are orphaned this way. |
Triage #71-#81 in one deliberate pass: rebase and merge what you want, close the rest citing #68. The org-wide gap is already filed as the proposal of 2026-09-03, "Dependabot was disabled org-wide, and no section of the design owns dependency-vulnerability monitoring". |
| 4 | Low | .github/workflows/ci.yml:58-61 | The upload is unauthenticated and non-failing, and this bump makes both matter slightly more. There is no token: input, so uploads rely on tokenless public-repo credit, which codecov rate-limits; and there is no fail_ci_if_error, so an upload that silently does not happen looks identical to one that did. flags: edb-py${{ matrix.python-version }} collapses the three OS legs of the 3×3 matrix into three flags, so ubuntu-22.04, macos-13 and windows-2022 coverage for the same Python version all land on one flag and overwrite rather than merge. All pre-existing, none introduced by this diff. |
After #82 lands and the job can actually reach :58: add token: ${{ secrets.CODECOV_TOKEN }}, and include matrix.os in the flag (edb-${{ matrix.os }}-py${{ matrix.python-version }}). Consider fail_ci_if_error: true only once the pipeline is otherwise green — turning it on against a red pipeline just adds noise. |
| 5 | Low | Repo settings — master branch protection |
gh api repos/embeddedos-org/eDB/branches/master/protection → required_status_checks: null, required_approving_review_count: 1. Nothing gates merge on a check. Low here because the effect is already covered by finding 1 and this PR is BLOCKED/REVIEW_REQUIRED, so a human must still approve. Already filed as the §28.3 proposal of 2026-09-03 and its addendum, which names eDB. |
Require CI — eDB once #82 makes it capable of going green. |
Not a finding, recorded as checked — this is why the bump needs no edit. The v4→v5 rewrite moved the action onto the Codecov CLI and renamed the singular file: input to plural files:. ci.yml:60 already uses files: coverage.xml, so the one rename that breaks most v4→v5 bumps does not apply here. flags: is unchanged across v4-v7. The rest of the range: v6.0.0 moves to Node 24 (Actions Runner ≥ 2.327.1, satisfied by all three hosted runner images in the matrix); v6.0.1 fixes VULN-1652, template injection in run: steps — a security fix worth having; v6.0.2/v7.0.0 are the same code, re-released because the codecovsecurity keybase account was deleted and signing moved to codecovsecops. No input used by this workflow was renamed or removed.
Architecture conformance
Conforms. Infrastructure-tier change (master design §21, "Infrastructure — .github, website, docs, CI templates") to a Tier-3 Advanced repository (§21, "eAI, eNI, eDB"). No source file, #include, link line or manifest entry, so §5.1 dependency direction is untouched; no public API or ABI moves, so §23.2's contracts are unaffected. Findings 1-2 bear on §28's evidence policy — a coverage step that has not run since May cannot support any Implemented or Validated claim resting on test coverage — but that gap is already filed as §28.2 (2026-09-02), §28.3 (2026-09-03) and the required_status_checks addendum (2026-09-03), which already names eDB and this exact branches: [main] trigger mismatch. No new proposal appended — this PR produced no gap that is not already written down.
Proposed changes
Order matters, and this PR is last:
- Land #82 so
ci.yml:33stops failing on a file that does not exist, and thetestjob can reach:58for the first time in months (finding 2). - Add
timeout-minutesto thetestjob (finding 2, second half). - Rebase this PR onto
mastersoCI — eDBtriggers (finding 1). Only then does merging it mean anything. - Separately, add the codecov token and fix the flag to include
matrix.os(finding 4), and triage the eleven orphaned dependabot PRs (finding 3).
Verification I ran
gh pr view 81 --json baseRefOid→5e436bd6…;git show 5e436bd6:.github/workflows/ci.yml→pull_request: branches: [main]against a PR targetingmaster. Direct evidence for finding 1.git show origin/master:.github/workflows/ci.yml→:33pip install -r requirements.txt;:58-61the codecov step withfiles: coverage.xmlandflags: edb-py…; matrix at:16-18is 3 Python × 3 OS.git show origin/master:requirements.txt→ does not exist.gh run list --workflow=ci.yml --limit 8→ every run since 2026-05 concludedfailure; last threemasterruns24h0m2seach.gh run view 33472965435 --json jobs→ six legsfailure(9-40s), three legscancelledafter exactly 24hqueued. Evidence for finding 2.git show origin/master:.github/dependabot.yml→fatal: … exists on disk, but not in 'origin/master'; #68 "chore(ci): remove Dependabot" merged 2026-09-01. Evidence for finding 3.gh pr list→ #82autofix/ci-install-project-depsis open and already covers therequirements.txtdefect, which is why I opened no fix PR for it.gh api repos/embeddedos-org/eDB/branches/master/protection→required_status_checks: null, reviews1.- Read the v5.5.x/v6.0.0/v6.0.1/v6.0.2/v7.0.0 release notes from the PR body for the compatibility statement above.
Not checked
- Nothing was executed. No workflow ran with
codecov-action@v7, no coverage was uploaded, and none can be until findings 1 and 2 are addressed. The compatibility conclusion rests on comparing the documented input changes against the actualwith:block — sound for that question, not a substitute for a run. - I did not check whether a
CODECOV_TOKENsecret exists in this repository, only that the workflow does not reference one. Finding 4's token recommendation assumes one would need to be added; that assumption is unverified. - I did not open a job log for the three starved matrix legs, so I have not confirmed which OS legs they are —
name: Test (Python ${{ matrix.python-version }})atci.yml:13omitsmatrix.os, so all nine legs report under three names.macos-13/windows-2022starvation is consistent with the 24hqueuedduration but is inferred, not observed. - I did not verify what the eDB README currently claims about coverage, so I make no statement about whether a published badge is stale — only that this workflow has uploaded nothing.
- The local eDB checkout has diverged from
origin/master(1 ahead, 3 behind) with a clean tree; every file above was read fromorigin/masteror from the PR base viagit show. I did not stash, reset, rebase or check out anything.
Automated architecture review of ee5358c8dee8 — scheduled, model claude-opus-5, checked against the EmbeddedOS Master Design v2.0. Advisory only: this reviewer never approves, requests changes, or merges. Reply here to discuss or push back — a wrong finding is a bug worth reporting.
1 participant
Bumps codecov/codecov-action from 4 to 7.
Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
fb8b358chore(release): 7.0.0 (#1957)ca0a928ci: remove Enforce License Compliance workflow (#1950)e79a696chore(release): 6.0.1 (#1949)51e6422fix: prevent template injection in run: steps (VULN-1652) (#1947)57e3a13Th/6.0.0 (#1928)f67d33dRevert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...75cd116chore(release): 5.5.4 (#1927)87d39f4Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926)1af5884chore(release): bump to 5.5.3 (#1922)c143300build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#1874)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)