Repository navigation
chore: declare the Codecov secret, fix the CodeQL input and add a Dependabot cooldown - #126
Conversation
…endabot cooldown - py-coverage.yml declares CODECOV_TOKEN, so callers can pass just that secret instead of secrets: inherit (zizmor secrets-inherit). - codeql.yml: language had a default but was required, so the default never applied (actionlint). - Dependabot: 7-day cooldown (zizmor dependabot-cooldown).
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 44 minutes. View limit details
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
GitHub Actions cooldown .github/dependabot.yml |
GitHub Actions dependency updates now have a default 7-day cooldown. |
CodeQL workflow input
| Layer / File(s) | Summary |
|---|---|
Optional language input .github/workflows/codeql.yml |
The language input is no longer required. Its type and "python" default remain unchanged. |
Coverage workflow secret
| Layer / File(s) | Summary |
|---|---|
Optional Codecov token .github/workflows/py-coverage.yml |
The reusable workflow accepts an optional CODECOV_TOKEN secret and describes it as the token for uploading reports to Codecov. |
Estimated code review effort: 2 (Simple) | ~8 minutes
Merge Risk: 
1c9df
-
The workflow and Dependabot configuration changes are valid and narrowly scoped, with no identified merge-blocking risk.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies all three main changes: declaring the Codecov secret, fixing the CodeQL input, and adding a Dependabot cooldown. Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
| secrets: | ||
| CODECOV_TOKEN: | ||
| description: Token for uploading the report to Codecov | ||
| required: false |
There was a problem hiding this comment.
I thought CodeCov requires a token to upload coverage reports now. I think needs to be required: true.
There was a problem hiding this comment.
Right, it's required: true now (dc795bf). The only caller, clang-tools-pip, uses secrets: inherit, so it still gets the token. Once this merges, pip will pass CODECOV_TOKEN explicitly instead of inheriting everything.
Generated by Claude Code
Small fixes from running zizmor and actionlint over the org:
py-coverage.ymlnow declares theCODECOV_TOKENsecret (required, since Codecov needs a token for uploads). clang-tools-pip calls it withsecrets: inherit, which zizmor flags because the called workflow then gets every secret of the repo. With the secret declared, callers can pass onlyCODECOV_TOKEN. Callers that keepsecrets: inheritstill get the token. After this merges, clang-tools-pip can switch to the explicit secret (follow-up to clang-tools-pip#243).codeql.yml:languagehaddefault: "python"butrequired: true, so the default could never apply (actionlint). It is now optional. All three callers (cpp-linter, clang-tools-pip, cpp-linter-hooks) are Python.dependabot.yml: 7-day cooldown, as in cpp-linter.zizmor now reports no findings here.