Skip to content

chore(deps): update codecov/codecov-action action to v7 #569

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LightOfHeaven1994 merged 1 commit into from
Jun 18, 2026
Merged

chore(deps): update codecov/codecov-action action to v7 #569

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
- run: npm run ci:verify
- name: Upload code coverage
uses: codecov/codecov-action@v6.0.0
uses: codecov/codecov-action@v7.0.0

@coderabbitai coderabbitai Bot Jun 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/test.yml | sed -n '20,35p'

Repository: RedHatInsights/tasks-frontend

Length of output: 909

🌐 Web query:

codecov-action v7.0.0 github release commit sha

💡 Result:

The commit SHA for the codecov-action v7.0.0 release is fb8b3582c8e4def4969c97caa2f19720cb33a72f [1][2][3]. This release was merged via pull request #1957 on June 7, 2026 [4][1]. The version bump to 7.0.0 primarily addressed GPG verification failures by updating the Codecov Wrapper submodule to fetch the PGP key from the codecovsecops Keybase account [4][2][5].

Citations:

🌐 Web query:

github actions pinning immutable commit sha best practices

💡 Result:

Pinning GitHub Actions to a full-length commit SHA is a critical security best practice to prevent supply chain attacks, such as tag-retargeting or malicious updates to mutable references [1][2][3]. Best Practices for Pinning GitHub Actions: 1. Use Full-Length Commit SHAs: Always reference actions using their full 40-character commit SHA [1][4]. Unlike tags (e.g., @v4) or branch names (e.g., @main), which are mutable pointers that can be changed by repository maintainers or attackers, a commit SHA is immutable and guarantees that the exact code you audited is the code that executes [2][5][6]. 2. Maintain Human-Readable References: To keep workflows readable and facilitate intentional updates, include the version tag as a comment on the same line as the SHA [2][5][7]. Example: - uses: actions/checkout@3df4ab1 # v4.0.0 3. Automate Maintenance with Tooling: Pinning requires active management to receive security patches and feature updates [2][3]. Use automated dependency update tools like Dependabot or Renovate [2][6]. Both tools are designed to recognize SHA-pinned actions and will automatically open pull requests to update the SHA and the version comment together [8][7]. 4. Enforce Policies: Organizations can mitigate risk by enabling policies that require all actions to be pinned to a full commit SHA [1][9]. When enabled, any workflow using a non-pinned action will fail, ensuring consistency across your organization [2][8]. 5. Audit the Dependency Tree: Remember that action pinning should be applied recursively [8]. If you maintain custom actions that consume other actions, you should pin those internal references to commit SHAs as well [8]. 6. Complementary Security Measures: While SHA pinning prevents unauthorized code changes, it does not replace the need for other security practices [3]. Continue to vet the creators of the actions you use, audit the action's source code for malicious behavior or excessive permissions, and use tools like Zizmor or OpenSSF Scorecards to detect unpinned actions and other risky configurations [10][11][6]. By adopting these practices, you eliminate the risk of an attacker compromising an action’s upstream tag to inject malicious code into your CI/CD pipeline [2][5].

Citations:

Pin the Codecov action to an immutable commit SHA.

codecov/codecov-action@v7.0.0 is a mutable tag; GitHub's security guidance requires pinning to a full-length commit SHA to prevent supply chain attacks. Update to the v7.0.0 release commit with a version comment for readability.

🔒 Proposed fix 
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
uses: codecov/codecov-action@v7.0.0
uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
🧰 Tools
🪛 zizmor (1.25.2)

[error] 28-28: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml at line 28, The codecov/codecov-action step is
using a mutable tag reference (v7.0.0) instead of a full-length immutable commit
SHA, which creates a supply chain security risk. Replace the uses statement for
codecov/codecov-action with a reference to the specific commit SHA for the
v7.0.0 release, and include a comment indicating which version it corresponds to
for maintainability.

Source: Linters/SAST tools

with:
fail_ci_if_error: true
files: ./coverage/coverage-final.json,./coverage-jest/coverage-final.json,./coverage-cypress/coverage-final.json
Expand Down
Loading