chore(deps): update codecov/codecov-action action to v7 - #569
Conversation
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates the GitHub Actions test workflow to use codecov/codecov-action v7.0.0 instead of v6.0.0 for uploading coverage reports, keeping all other test configuration intact. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
WalkthroughThe GitHub Actions test workflow is updated to use ChangesCI Workflow Update
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~1 minute 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #569 +/- ##
=======================================
Coverage 84.18% 84.18%
=======================================
Files 86 86
Lines 1998 1998
Branches 662 670 +8
=======================================
Hits 1682 1682
Misses 279 279
Partials 37 37 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test.yml:
- Line 28: The codecov/codecov-action step is using a mutable tag reference
(v7.0.0) instead of a full-length immutable commit SHA, which creates a supply
chain security risk. Replace the uses statement for codecov/codecov-action with
a reference to the specific commit SHA for the v7.0.0 release, and include a
comment indicating which version it corresponds to for maintainability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Enterprise
Run ID: cdb47ebd-7dcb-4504-839d-143f0ad2392c
📒 Files selected for processing (1)
.github/workflows/test.yml
| - run: npm run ci:verify | ||
| - name: Upload code coverage | ||
| uses: codecov/codecov-action@v6.0.0 | ||
| uses: codecov/codecov-action@v7.0.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/test.yml | sed -n '20,35p'Repository: RedHatInsights/tasks-frontend
Length of output: 909
🌐 Web query:
codecov-action v7.0.0 github release commit sha
💡 Result:
The commit SHA for the codecov-action v7.0.0 release is fb8b3582c8e4def4969c97caa2f19720cb33a72f [1][2][3]. This release was merged via pull request #1957 on June 7, 2026 [4][1]. The version bump to 7.0.0 primarily addressed GPG verification failures by updating the Codecov Wrapper submodule to fetch the PGP key from the codecovsecops Keybase account [4][2][5].
Citations:
- 1: codecov/codecov-action@v6.0.1...v7.0.0
- 2: codecov/codecov-action@e79a696...fb8b358
- 3: codecov/codecov-action@v5...v7
- 4: chore(release): 7.0.0 codecov/codecov-action#1957
- 5: Migrating keybase accounts/gpg verification failure codecov/codecov-action#1956
🌐 Web query:
github actions pinning immutable commit sha best practices
💡 Result:
Pinning GitHub Actions to a full-length commit SHA is a critical security best practice to prevent supply chain attacks, such as tag-retargeting or malicious updates to mutable references [1][2][3]. Best Practices for Pinning GitHub Actions: 1. Use Full-Length Commit SHAs: Always reference actions using their full 40-character commit SHA [1][4]. Unlike tags (e.g., @v4) or branch names (e.g., @main), which are mutable pointers that can be changed by repository maintainers or attackers, a commit SHA is immutable and guarantees that the exact code you audited is the code that executes [2][5][6]. 2. Maintain Human-Readable References: To keep workflows readable and facilitate intentional updates, include the version tag as a comment on the same line as the SHA [2][5][7]. Example: - uses: actions/checkout@3df4ab1 # v4.0.0 3. Automate Maintenance with Tooling: Pinning requires active management to receive security patches and feature updates [2][3]. Use automated dependency update tools like Dependabot or Renovate [2][6]. Both tools are designed to recognize SHA-pinned actions and will automatically open pull requests to update the SHA and the version comment together [8][7]. 4. Enforce Policies: Organizations can mitigate risk by enabling policies that require all actions to be pinned to a full commit SHA [1][9]. When enabled, any workflow using a non-pinned action will fail, ensuring consistency across your organization [2][8]. 5. Audit the Dependency Tree: Remember that action pinning should be applied recursively [8]. If you maintain custom actions that consume other actions, you should pin those internal references to commit SHAs as well [8]. 6. Complementary Security Measures: While SHA pinning prevents unauthorized code changes, it does not replace the need for other security practices [3]. Continue to vet the creators of the actions you use, audit the action's source code for malicious behavior or excessive permissions, and use tools like Zizmor or OpenSSF Scorecards to detect unpinned actions and other risky configurations [10][11][6]. By adopting these practices, you eliminate the risk of an attacker compromising an action’s upstream tag to inject malicious code into your CI/CD pipeline [2][5].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://architecture.lullabot.com/adr/20260505-pin-github-actions-to-hash/
- 3: https://emmer.dev/blog/pin-your-github-actions-to-protect-against-mutability/
- 4: https://www.stepsecurity.io/blog/pinning-github-actions-for-enhanced-security-a-complete-guide
- 5: https://safeguard.sh/resources/blog/github-actions-pinning-sha-vs-tag
- 6: https://www.cncf.io/blog/2026/05/04/securing-github-actions-ci-dependencies-recipe-card/
- 7: https://secure-pipelines.com/ci-cd-security/github-actions-security-cheat-sheet/
- 8: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 9: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 10: https://github.com/github/docs/blob/962a1c8dccb8c0f66548b324e5b921b5e4fbc3d6/content/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions.md
- 11: https://cheatsheetseries.owasp.org/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.html
Pin the Codecov action to an immutable commit SHA.
codecov/codecov-action@v7.0.0 is a mutable tag; GitHub's security guidance requires pinning to a full-length commit SHA to prevent supply chain attacks. Update to the v7.0.0 release commit with a version comment for readability.
🔒 Proposed fix
- uses: codecov/codecov-action@v7.0.0
+ uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: codecov/codecov-action@v7.0.0 | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yml at line 28, The codecov/codecov-action step is
using a mutable tag reference (v7.0.0) instead of a full-length immutable commit
SHA, which creates a supply chain security risk. Replace the uses statement for
codecov/codecov-action with a reference to the specific commit SHA for the
v7.0.0 release, and include a comment indicating which version it corresponds to
for maintainability.
Source: Linters/SAST tools
2 participants
This PR contains the following updates:
v6.0.0→v7.0.0Warning
Some dependencies could not be looked up. Check the warning logs for more information.
Release Notes
codecov/codecov-action (codecov/codecov-action)
v7.0.0Compare Source
codecovsecurityaccount. We have deleted the account and are usingcodecovsecopswith the original gpg keyWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v7.0.0
v6.0.2Compare Source
This is a copy of the
v7.0.0release to make updates easierWhat's Changed
Full Changelog: codecov/codecov-action@v6.0.1...v6.0.2
v6.0.1Compare Source
What's Changed
Full Changelog: codecov/codecov-action@v6.0.0...v6.0.1
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.