Skip to content

ci: upload coverage to Codecov #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nficano merged 1 commit into from
May 25, 2026
+12 −2
Merged

ci: upload coverage to Codecov #53

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 12 additions & 2 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,8 +73,18 @@ jobs:
if: hashFiles('.php-cs-fixer.dist.php', '.php-cs-fixer.php') != ''
run: vendor/bin/php-cs-fixer fix --dry-run --diff

- name: Run PHPUnit
run: vendor/bin/phpunit
- name: Run PHPUnit (with Clover coverage)
run: vendor/bin/phpunit --coverage-clover=coverage.xml

# Non-blocking: a Codecov outage cannot break CI.
- name: Upload coverage to Codecov
# codecov/codecov-action v6.0.1
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
with:
fail_ci_if_error: false
flags: unittests
files: ./coverage.xml
token: ${{ secrets.CODECOV_TOKEN }}
Comment on lines +79 to +87
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the codecov-action SHA corresponds to v6.0.1 and check for latest release

# Fetch the commit SHA for the v6.0.1 tag
echo "=== Checking SHA for v6.0.1 tag ==="
gh api repos/codecov/codecov-action/git/ref/tags/v6.0.1 --jq '.object.sha' || echo "Tag v6.0.1 not found"

# Check what the provided SHA actually points to
echo -e "\n=== Checking provided SHA ==="
gh api repos/codecov/codecov-action/commits/e79a6962e0d4c0c17b229090214935d2e33f8354 --jq '{sha: .sha, commit_message: .commit.message, author_date: .commit.author.date}' || echo "SHA not found"

# Get latest release
echo -e "\n=== Latest release ==="
gh api repos/codecov/codecov-action/releases/latest --jq '{tag: .tag_name, published: .published_at, name: .name}'

# Check for any security advisories
echo -e "\n=== Security advisories ==="
gh api graphql -f query='
{
  repository(owner: "codecov", name: "codecov-action") {
    vulnerabilityAlerts(first: 5) {
      nodes {
        securityVulnerability {
          advisory {
            summary
            severity
          }
          package {
            name
          }
        }
      }
    }
  }
}'

Repository: agentruntimecontrolprotocol/php-sdk

Length of output: 505

Clarify Codecov action pin: resolve v6.0.1 tag vs provided SHA mismatch.

e79a6962e0d4c0c17b229090214935d2e33f8354 is a commit whose message is chore(release): 6.0.1 (#1949), and the latest Codecov action release is v6.0.1 (no newer release). However, the v6.0.1 tag object SHA returned by the API is cddd853df119a48c5be31a973f8cd97e12e35e16, not the pinned e79..., so the “SHA corresponds to v6.0.1” assumption needs resolving (e.g., annotated tag vs target commit).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test.yml around lines 79 - 87, Summary: The Codecov action
is pinned to a commit SHA that doesn't match the v6.0.1 tag object, causing
confusion about which release is used; update the step that uses
codecov/codecov-action (the "Upload coverage to Codecov" step) to use a correct
ref. Fix by either (a) pinning to the canonical v6.0.1 tag (uses:
codecov/codecov-action@v6.0.1) so readers see the intended release, or (b) if
you require an exact commit, replace the SHA
e79a6962e0d4c0c17b229090214935d2e33f8354 with the tag object SHA returned by the
API (e.g., cddd853df119a48c5be31a973f8cd97e12e35e16) and add a brief inline
comment stating why the commit SHA is used instead of the tag to avoid future
confusion.


- name: Upload test artifacts on failure
if: failure()
Expand Down