Fix upload-codescene-coverage env

.github/actions/upload-codescene-coverage/CHANGELOG.md

@@ -21,3 +21,14 @@
 - Added restore keys to cache the CLI across minor versions.
 - Removed redundant checksum validation before executing the installer.
 - Reworded README reference to CHANGELOG.
+
+## v1.4.2
+- Fixed action load failure by removing unsupported `secrets` and `vars`
+  references in `action.yml`.
+- Documented required environment variables in the README.
+
+## v1.4.3
+- Added details about caching behavior and usage recommendations to the README.
+
+## v1.4.4
+- Wrapped README lines to 80 columns for consistency.

.github/actions/upload-codescene-coverage/README.md

@@ -6,8 +6,8 @@ Upload coverage reports to CodeScene and cache the CLI for faster runs.
 
 | Name  | Description                                | Required | Default |
 | ----- | ------------------------------------------ | -------- | ------- |
-| path  | Coverage file path (set to `__auto__` to infer) | no       | `__auto__` |
-| format | Coverage format (`cobertura` or `lcov`)     | no       | `cobertura` |
+| path  | Coverage file path; use `__auto__` to infer | no       | `__auto__` |
+| format | Coverage format (`cobertura` or `lcov`) | no       | `cobertura` |
 
 If `path` is left as `__auto__`, the action will look for `lcov.info` when
 `format` is `lcov`, or `coverage.xml` when `format` is `cobertura`.
@@ -16,6 +16,11 @@ installer script. If `CODESCENE_CLI_SHA256` is provided, the installer
 is validated before execution. Any other value for `format` results in an
 error.
 
+## Environment variables
+
+- `CS_ACCESS_TOKEN` – CodeScene project access token (required)
+- `CODESCENE_CLI_SHA256` – SHA‑256 checksum for the installer (optional)
+
 ## Outputs
 
 None
@@ -29,5 +34,35 @@ None
     format: cobertura
 ```
 
+## Caching
+
+The CodeScene Coverage CLI is stored in `~/.local/bin/cs-coverage` and cached
+with [actions/cache](https://github.com/actions/cache). The cache key combines
+the runner OS and the CLI version extracted from the installer script. The cache
+is restored at the start of the job and saved after the job finishes.
+
+### Requirements
+
+- `CS_ACCESS_TOKEN` must be provided so the installer can download the CLI and
+  to authenticate uploads.
+- `CODESCENE_CLI_SHA256` should be set to the published checksum of the
+  installer to guard against tampering (optional).
+
+### Extent and limitations
+
+- GitHub limits each cache to 5 GB per operating system; old entries may be
+  evicted as new ones are created.
+- Caches are scoped to the runner OS, so Windows, macOS, and Linux caches are
+  independent.
+- If the CLI version changes or no cache entry exists, the installer runs again
+  and a new cache entry is created.
+
+### Effective use
+
+- Pin the installer checksum whenever possible to avoid using a compromised
+  download.
+- Keep your coverage file path consistent across jobs so subsequent steps can
+  locate it reliably.
+
 Release history is available in [CHANGELOG](CHANGELOG.md).
 

.github/actions/upload-codescene-coverage/action.yml

@@ -98,6 +98,3 @@ runs:
           "$file"
       shell: bash
 
-env:
-  CS_ACCESS_TOKEN: ${{ secrets.CS_ACCESS_TOKEN }}
-  CODESCENE_CLI_SHA256: ${{ vars.CODESCENE_CLI_SHA256 }}