Repository navigation
fix: restore coverage uploads and large PR reviews - #406
Conversation
Troublor
added
spec:unchanged
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Claude review status
✅ Review clean Last reviewed: head New this round: 0 finding(s), 0 question(s) · Resolved this round: 0 · Open questions: 0 |
🧬 Mutation testing — ✅ PASSNothing to test — no mutants were generated on the changed lines. |
There was a problem hiding this comment.
🟢 Approval recommended
No blocking issues were identified, and the action interfaces support these changes; workflow execution remains pending.
No open issues 🎉
What changed in this PR
Restores authenticated coverage uploads and enables automated reviews for PRs exceeding GitHub’s 300-file diff limit.
Changes:
- Uses Codecov OIDC with job-scoped permissions, fails on upload errors, and disables checkout credential persistence.
- Pins the review and App-token actions to verified revisions.
| File | Description |
|---|---|
.github/workflows/coverage.yml |
Configures OIDC authentication and strict upload failure handling. |
.github/workflows/claude.yml |
Pins actions supporting large-PR diffs and App identity forwarding. |
Review effort: Balanced
🧬 Mutation testingNo results at |
(cherry picked from commit 821577d) Conflict resolution: - .github/workflows/claude.yml: main's version, unchanged. - .github/workflows/coverage.yml: this branch's version, which already uploads over OIDC with fail_ci_if_error, continue-on-error and a warning step, and triggers on satin; main's persist-credentials: false is added to its checkout step.
Summary
Coverage jobs currently pass even though Codecov rejects uploads with
Token required because branch is protected: CODECOV_TOKEN is absent. Authenticate the coverage upload with GitHub OIDC, grant ID-token permission only to the coverage job, and fail the job when upload fails. Disable checkout credential persistence in that job.Review preparation also fails with HTTP 406 for PRs above GitHub's 300-file diff limit. Pin the review action to megaeth-labs/.github#48, which adds a complete Git diff fallback and forwards the configured App identity to analysis. Pin the verified App-token action revision supporting client-id.
Validation
No repository or organization secrets/variables need to be added or changed. Existing publish-environment CARGO_REGISTRY_TOKEN and GCP_AUTH_KEY remain required for releases; credential validity has not been rehearsed here.