From f9c97901f016524a3fe379a16a0d99d970cbec70 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Sat, 12 Sep 2026 19:40:27 +1000 Subject: [PATCH 1/2] fix(ci): pin codecov-action v7.0.0 and enforce the CLI signature check (LAB-3433) v6.0.0's dist/codecov.sh fetches the CLI signing key from keybase.io/codecovsecurity, an account Codecov deleted on 2026-06-07 (codecov/codecov-action#1956, HTTP 404). Key import fails, gpg --verify fails with "No public key", and because fail_ci_if_error was false the wrapper printed "CLI integrity verified" and executed the unverified binary anyway, on every green run since June. v7.0.0 (fb8b3582; v6.0.2 is the same commit) fetches keybase.io/codecovsecops, fingerprint 2703 4E7F DB85 0E0B BC2C 62FF 806B B28A ED77 9869. fail_ci_if_error is also the wrapper's signature-enforcement switch, so it must be true for the step to abort before exec. Step-level continue-on-error keeps the upload from reddening CI, which is all the old false was doing. --- .github/workflows/ci.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e572845..00915f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -123,11 +123,18 @@ jobs: - name: Test with coverage run: pnpm test:coverage + # fail_ci_if_error is also the wrapper's signature-enforcement switch. With + # false, a failed `gpg --verify` of the CLI's SHA256SUM is only logged and + # the unverified binary still executes — which v6.0.0 did on every run after + # Codecov deleted its keybase signing key (codecov/codecov-action#1956, + # 2026-06-07). Keep it true so the step aborts before exec; continue-on-error + # is what keeps the upload from reddening CI, which is all `false` ever did. - name: Upload coverage - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + continue-on-error: true with: files: ./packages/cachekit/coverage/lcov.info - fail_ci_if_error: false + fail_ci_if_error: true security: runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'cachekit-lean' }} From b7b46a91551d5c20bda001cef2fc92504bebab98 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Sat, 12 Sep 2026 19:49:18 +1000 Subject: [PATCH 2/2] docs(ci): sharpen the codecov signature-guard note (LAB-3433) Panel findings: the key was not deleted, its keybase hosting account moved; the 'all false ever did' clause contradicted the sentence before it; and a reader seeing the step orange on every run (the pre-existing tokenless rejection) needs to know how to tell the guard firing from a lost upload before reaching for the flag. --- .github/workflows/ci.yml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 00915f9..6c7e5fb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -123,12 +123,15 @@ jobs: - name: Test with coverage run: pnpm test:coverage - # fail_ci_if_error is also the wrapper's signature-enforcement switch. With + # fail_ci_if_error is also the wrapper's signature-enforcement switch: with # false, a failed `gpg --verify` of the CLI's SHA256SUM is only logged and # the unverified binary still executes — which v6.0.0 did on every run after - # Codecov deleted its keybase signing key (codecov/codecov-action#1956, - # 2026-06-07). Keep it true so the step aborts before exec; continue-on-error - # is what keeps the upload from reddening CI, which is all `false` ever did. + # Codecov moved its public key off the keybase account v6.0.0 fetched it + # from (codecov/codecov-action#1956, 2026-06-07). Keep it true so the step + # aborts before exec; continue-on-error keeps the upload from reddening CI. + # When this step is orange, read the log: "Could not verify signature" is + # the guard working (never silence it); an upload error (token, network) + # only loses that upload. - name: Upload coverage uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 continue-on-error: true