chore(deps): bump codecov/codecov-action from 4 to 6#40
Conversation
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 6. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v4...v6) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
the
github_actions
📝 WalkthroughWalkthroughThis pull request upgrades the Codecov GitHub Actions workflow step from version 4 to version 6, updating the action invoked during the "Upload coverage reports to Codecov" stage in the test workflow. ChangesCodecov Action Version Upgrade
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test.yml:
- Line 37: Update the GitHub Actions step that references the Codecov action
(the uses line currently set to codecov/codecov-action@v6) to pin it to the
immutable commit SHA by replacing the tag with
codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354; ensure the uses
entry exactly matches that SHA to prevent CI supply-chain drift.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ba604bfb-1ec1-4852-a1a3-8f797e8243c7
📒 Files selected for processing (1)
.github/workflows/test.yml
|
|
||
| - name: Upload coverage reports to Codecov | ||
| uses: codecov/codecov-action@v4 | ||
| uses: codecov/codecov-action@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Read-only verification: resolve current commit behind codecov/codecov-action v6 tag
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
🏁 Script executed:
gh api repos/codecov/codecov-action/git/ref/tags/v6 | jq -r '.object.sha'Repository: OpenDevFlow/md-latex
Length of output: 105
Pin Codecov action to an immutable commit SHA
.github/workflows/test.yml Line 37 uses the mutable tag codecov/codecov-action@v6; pin it to codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 to prevent CI supply-chain drift.
🔒 Suggested change
- uses: codecov/codecov-action@v6
+ uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: codecov/codecov-action@v6 | |
| uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 37-37: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yml at line 37, Update the GitHub Actions step that
references the Codecov action (the uses line currently set to
codecov/codecov-action@v6) to pin it to the immutable commit SHA by replacing
the tag with codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354;
ensure the uses entry exactly matches that SHA to prevent CI supply-chain drift.
Bumps codecov/codecov-action from 4 to 6.
Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
e79a696chore(release): 6.0.1 (#1949)51e6422fix: prevent template injection in run: steps (VULN-1652) (#1947)57e3a13Th/6.0.0 (#1928)f67d33dRevert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...75cd116chore(release): 5.5.4 (#1927)87d39f4Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926)1af5884chore(release): bump to 5.5.3 (#1922)c143300build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#1874)671740achore(release): 5.5.2 (#1902)96b38e9chore:disable_searchalignment (#1881)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Summary by CodeRabbit