fix(ci): authenticate Codecov uploads with a repository token - #56
Merged
Conversation
Reproduce the `Repository not found` upload failure on a cheap ubuntu runner instead of the 5-job macOS coverage matrix. Runs three variants in one job: plain OIDC, OIDC with an explicit slug, and OIDC against the legacy upload endpoint. Temporary; removed once the cause is identified.
Probes 1-3 ruled out slug derivation and the upload endpoint: an explicit slug and the legacy endpoint both return the same 404. Add a tokenless upload probe to test whether the OIDC path alone is broken, and a claim inspection step that prints only non-secret OIDC claims.
The Codecov GitHub App is installed with access to this repo and the dashboard shows the repo, so the remaining cause matches codecov-action issue 1965: the account record no longer matches after the Harness migration. Probe the repository upload token path now that the account has been re-onboarded and the secret is set.
The Codecov upload service still indexes this repository under its former owner name, `gumob/fluidable`. OIDC and tokenless uploads resolve the repo by the slug the CI reports, `futamura/Fluidable`, which that index does not contain, so every upload returned 404 `Repository not found`. A repository upload token resolves the record directly and is unaffected by the stale name. Drop the `id-token: write` permission, which only OIDC needed.
The probe identified the cause and confirmed the fix: `coverage.yml` now uploads with a repository token and all five jobs report to Codecov.
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
目的
mainpush で走るcoverage.ymlが全 5 job でUpload ... to Codecovstep のみ失敗し、workflow 全体が赤くなっていた問題を修正する (project memory の task 33)。原因
Codecov の upload service が本 repository を旧 owner 名
gumob/fluidableで index したままだった。OIDC / tokenless upload は CI が報告する slugfutamura/Fluidableで repo を解決するため、この index に該当が無く 404Repository not foundを返していた。read 側 (dashboard,
api.codecov.io/api/v2) は owner rename を追従済みで repo を正常に返すため、当初「repo 未登録」と誤診されていた。ubuntu runner 上の一時 probe workflow で 6 通りを 14 秒 / run で検証した。
repository_owner_idも GitHub と一致probe 6 の結果 URL が
https://app.codecov.io/github/gumob/fluidable/commit/...を指しており、record 名が旧 owner のままであることが確定した。主要変更点
coverage.ymlの Codecov step 2 箇所をuse_oidc: trueからtoken: ${{ secrets.CODECOV_TOKEN }}へ変更id-token: writepermission を削除CODECOV_TOKENを repository secret として設定 (値は非公開)Verification
gh workflow run coverage.yml --ref fix/codecov-oidc-upload-> run32345046410が 全 5 job success。upload step 5 件すべて successstate: complete/ci_passed: true/coverage: 89.8/files: 107unit-coverageは既知の blur snapshot flake (Tests/UIKitSpec.swift:1482) で失敗。gh run rerun --failedで success。本変更とは無関係UI 変更なし。Swift / Storyboard / layout / transition に触れないため Simulator 確認は不要。
既知の制約
OIDC へ戻すには Codecov 側で upload service の repo record を
futamura/Fluidableへ更新してもらう必要があり、こちら側の設定では不可能。