Bump codecov/codecov-action from 5 to 7 - #857
Conversation
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5 to 7. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](codecov/codecov-action@v5...v7) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a6ee3aa. Configure here.
| uv run coverage xml | ||
| - name: Upload coverage | ||
| uses: codecov/codecov-action@v5 | ||
| uses: codecov/codecov-action@v7 |
There was a problem hiding this comment.
Deprecated file parameter silently ignored in codecov v7
Medium Severity
The file input was deprecated in codecov-action v5 and removed from the action.yml in v7. Since the workflow still uses file: ./coverage.xml instead of files: ./coverage.xml, the coverage file path is silently ignored after this version bump. Combined with fail_ci_if_error: false, coverage uploads will quietly stop working without any CI failure signal.
Reviewed by Cursor Bugbot for commit a6ee3aa. Configure here.
Bumps codecov/codecov-action from 5 to 7.
Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
fb8b358chore(release): 7.0.0 (#1957)ca0a928ci: remove Enforce License Compliance workflow (#1950)e79a696chore(release): 6.0.1 (#1949)51e6422fix: prevent template injection in run: steps (VULN-1652) (#1947)57e3a13Th/6.0.0 (#1928)f67d33dRevert "Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0""...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)Note
Low Risk
Single third-party GitHub Action version bump in CI only; no application or runtime code changes.
Overview
Updates the Upload coverage step in the
test-unixCI job to usecodecov/codecov-action@v7instead of@v5. Inputs (coverage.xml,unitflag,OSenv var,fail_ci_if_error: false) are unchanged.Reviewed by Cursor Bugbot for commit a6ee3aa. Bugbot is set up for automated code reviews on this repo. Configure here.