From e419088177c4ed225f4a3e9027d738aacd397d6c Mon Sep 17 00:00:00 2001 From: patramsey Date: Sun, 2 Aug 2026 13:28:22 -0600 Subject: [PATCH] ci: drop the unused CODECOV_TOKEN reference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codecov accepts tokenless uploads from public repositories, so the secret reference was never needed. Confirmed against a known-working public-repo configuration, which uploads and reports with no token input at all. This is a correction to the config, not a fix for the failed upload. An empty `token:` input and an absent one are the same thing to the action — it checks `[ -n "$INPUT_TOKEN" ]` and skips when empty, which is exactly what the failing run did ("Token length: 0"). Removing the line changes no behavior; it stops the workflow from pointing at a secret that does not exist and should not need to. The upload that failed was rejected because the repository is not activated on Codecov's side ("active": false, "activated": false via their API), not because it lacked credentials. Their error string for that case — "Token required - not valid tokenless upload" — reads like an auth problem and sent me down the wrong path. Activation is a console-side action; nothing in this repository can do it. --- .github/workflows/ci.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cf05bb9..6106b64 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,6 +40,10 @@ jobs: run: go test -race -count=1 -coverprofile=coverage.out ./... - name: Upload coverage + # No token: Codecov accepts tokenless uploads from public repositories + # once the repository is activated on their side. Adding a secret would + # be a credential to store, rotate, and leak for no gain. + # # continue-on-error because coverage reporting is not a correctness # signal. Codecov being down, rate-limiting, or rejecting an upload # must not turn a PR red when the tests themselves passed. @@ -47,7 +51,6 @@ jobs: uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: files: coverage.out - token: ${{ secrets.CODECOV_TOKEN }} fail_ci_if_error: false lint: