Codecov changes master or main coverage on PRs from forks

[MarvinJWendt]

Hi, I am using this action on my project pterm/pterm and today we got a PR that somehow changed my overall coverage for the master branch, even that I haven't merged it into master. I could reproduce that in this PR that I made: pterm/pterm#218 which reduces the Coverage from 100% to 98% even tho I haven't merged it.

It also detects that the PR commits are in master, which they aren't

This never happened before, and now someone could easily manipulate my coverage down to 0%.

[ethanwharris]

+1 We are also seeing this issue. A lot of first-time contributor PRs come from master branches so coverage drops can be quite frequent for some projects.

[thomasrockhu-codecov]

Tracking internally as 3043

[eliatcodecov]

This underlying bug is fixed for the Codecov CLI (see: codecov/engineering-team#661). this work is not in the node uploader. We will be moving the codecov github action to use the CLI instead of the node uploader soon (see: codecov/engineering-team#813). Once this is done, this problem be resolved for customers using the github action.

[rohan-at-sentry]

Hi everyone

We've released a new version of the codecov action and CLI that should help address the issue you're seeing here. Here's a link to our blog outlining the latest update including how to upgrade to the CLI. You can also visit our docs for more detailed information on how to get set up with the CLI, especially if you're not using our Github Action, Bitrise Step or CircleCI orb.

[thomasrockhu-codecov]

Closing for now. If the CLI is not fixing the issue, feel free to comment to reopen