chore: bump codecov/codecov-action from 6 to 7 in the actions group#14
chore: bump codecov/codecov-action from 6 to 7 in the actions group#14dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the actions group with 1 update: [codecov/codecov-action](https://github.com/codecov/codecov-action). Updates `codecov/codecov-action` from 6 to 7 - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v6...v7) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
🤖 Augment PR SummarySummary: Updates the GitHub Actions CI workflow to use Codecov Action v7 for coverage uploads. 🤖 Was this summary useful? React with 👍 or 👎 |
![augmentcode[bot]](https://avatars.githubusercontent.com/in/1027498?s=60&v=4){kind=small}
|
|
||
| - name: Upload coverage reports to Codecov | ||
| uses: codecov/codecov-action@v6 | ||
| uses: codecov/codecov-action@v7 |
There was a problem hiding this comment.
Using a floating tag (codecov/codecov-action@v7) means the exact code being executed can change over time; consider pinning to a specific commit SHA to reduce supply-chain risk and improve build reproducibility.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
| uses: codecov/codecov-action@v6 | ||
| uses: codecov/codecov-action@v7 | ||
| with: | ||
| token: ${{ secrets.CODECOV_TOKEN }} |
There was a problem hiding this comment.
On pull_request runs from forks, secrets.CODECOV_TOKEN won’t be available, which can cause this upload step to fail; consider guarding the step or switching to a tokenless/OIDC setup if supported for this repo.
Severity: medium
🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.
Bumps the actions group with 1 update: codecov/codecov-action.
Updates
codecov/codecov-actionfrom 6 to 7Release notes
Sourced from codecov/codecov-action's releases.
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions