From 368b48b56d1866e280e1f256c13a9062bd604961 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Sun, 20 Sep 2026 00:06:56 +1000 Subject: [PATCH 1/2] fix(ci): upload coverage to Codecov via OIDC (LAB-3435) Every upload from the coverage job was rejected with "Token required because branch is protected": the step ran tokenless and the repo has no CODECOV_TOKEN. Grant the job id-token: write and set use_oidc: true so codecov-action v7.0.0 mints a short-lived token per run, with no secret to store or rotate. Job-level permissions replace the workflow block, so contents: read is restated. continue-on-error stays: the action skips OIDC on fork PRs and uploads tokenless, so a fork run can still be rejected and must not redden CI. --- .github/workflows/ci.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6c7e5fbb..ae4c22cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -103,6 +103,9 @@ jobs: coverage: runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'cachekit-lean' }} + permissions: + contents: read + id-token: write # Required for Codecov OIDC steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 @@ -131,12 +134,16 @@ jobs: # aborts before exec; continue-on-error keeps the upload from reddening CI. # When this step is orange, read the log: "Could not verify signature" is # the guard working (never silence it); an upload error (token, network) - # only loses that upload. + # only loses that upload. Codecov requires a token on protected branches; + # use_oidc mints one per run from id-token: write above (no stored secret). + # The action skips OIDC on fork PRs and uploads tokenless, so a fork run + # may still show an upload rejection here — expected, not a regression. - name: Upload coverage uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 continue-on-error: true with: files: ./packages/cachekit/coverage/lcov.info + use_oidc: true fail_ci_if_error: true security: From 17cb22ebb8fbae5442d159f1e245580354c78e08 Mon Sep 17 00:00:00 2001 From: Ray Walker Date: Sun, 20 Sep 2026 00:15:12 +1000 Subject: [PATCH 2/2] fix(ci): make the Codecov OIDC comment name the actionable failure Codecov's "protected" means any same-repo branch, not GitHub's protected main, and the pinned action relabels fork branches for the tokenless path, so a fork rejection is not the expected case. Say what a recurring "Token required" on a same-repo run means instead: OIDC did not mint. --- .github/workflows/ci.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ae4c22cd..32123c9d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -134,10 +134,10 @@ jobs: # aborts before exec; continue-on-error keeps the upload from reddening CI. # When this step is orange, read the log: "Could not verify signature" is # the guard working (never silence it); an upload error (token, network) - # only loses that upload. Codecov requires a token on protected branches; - # use_oidc mints one per run from id-token: write above (no stored secret). - # The action skips OIDC on fork PRs and uploads tokenless, so a fork run - # may still show an upload rejection here — expected, not a regression. + # only loses that upload. Codecov requires a token on any same-repo branch + # (its error says "protected"). use_oidc mints one per run via the job's + # id-token: write, so no stored secret. Forks never attempt OIDC and upload + # tokenless; "Token required" on a same-repo run means OIDC did not mint. - name: Upload coverage uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 continue-on-error: true