ci(coverage): bump codecov-action v5 -> v7 for Keybase GPG key migration#412
Merged
Merged
Conversation
Codecov migrated the Keybase account hosting the uploader's GPG public key. With codecov-action@v5 the wrapper fetches that key from the old path, gets non-OpenPGP data, and the upload step fails verification with "gpg: no valid OpenPGP data found" / "Can't check signature: No public key", breaking the coverage job on every push to main. v7.0.0 points the uploader at the migrated key and restores coverage uploads. GPG verification and fail_ci_if_error stay enabled.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the CI coverage workflow to use a newer Codecov GitHub Action version to address a GPG public key migration issue that caused the “Upload coverage to Codecov” step to fail on main.
Changes:
- Bump
codecov/codecov-actionfromv5tov7in thecoveragejob.
mfaferek93
approved these changes
Jun 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The
coveragejob has failed on every push tomainsince June 7 at the Upload coverage to Codecov step:Codecov migrated the Keybase account that hosts the uploader's GPG public key.
codecov/codecov-action@v5fetches that key from the pre-migration path, receives non-OpenPGP data, so the key import yields 0 keys and the subsequent signature check of the downloaded CLI fails. Because the step runs withfail_ci_if_error: true, the whole coverage job goes red. All tests pass and the HTML coverage artifact uploads fine - only the third-party uploader's GPG self-verification breaks.Upstream released
codecov-action@v7.0.0specifically to fix the migrated key path (see codecov/codecov-action#1956, #1955). This bumps@v5->@v7. GPG verification andfail_ci_if_error: truestay enabled - no validation is skipped.Issue
N/A - one-line CI hotfix for an upstream tooling breakage.
Type
Testing
The Codecov step is gated to
pushonmain, so PR CI does not exercise it; it runs on the first push tomainafter merge. Change is config-only (action major-version bump); the rest of CI validates the workflow parses and runs.Checklist