codecov / codecov/codecov-circleci-orb
[BUG] All Versions Pre-V6 Have Broken CLI Validation Making them Practically Unusable
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 26
- Forks
- 47
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
The GPG key that is used to validate the CLI was moved: https://github.com/codecov/codecov-cli/issues/716
All older versions of the orb have a hard-coded reference to the old location and V6 was only just released yesterday.
To Reproduce
Use the codecov/upload command with any older version without disabling CLI validation.
Expected behavior
There should have been a reasonable warning before removing the old key and/or the updated key reference should have been backported to older orb versions first.
Product Area
Coverage.
Commit and CI link
V6 update: https://github.com/codecov/codecov-circleci-orb/commit/5ab5e974da74ae1edb1249c6c5327b9d0c93b62f
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing the V6 update in commit 5ab5e974da74ae1edb1249c6c5327b9d0c93b62f with the older orb versions and trace validation for the codecov/upload command. Reproduce the failure with an older version; done means older versions no longer use the moved GPG key reference or provide the warning described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100