diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-08-12 21:52:35 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-08-12 21:52:35 +0300 |
| commit | 0e0ad13beb357b83faffcda48586641ebfd88b7b (patch) | |
| tree | 85de56c88f6ab7923b1848b4568c65b1174fdca7 | |
| parent | cf580caa3db4b4b1adaa541301d3d9ab8de5323b (diff) | |
| download | codecov-0e0ad13beb357b83faffcda48586641ebfd88b7b.tar.gz codecov-0e0ad13beb357b83faffcda48586641ebfd88b7b.zip | |
fix: address adversarial-review findings (validate error visibility + portable paste snippets)
- validate.yml: stream curl output directly; the response=$(...) capture under
set -euo pipefail swallowed the validation error body on non-2xx (job failed
with a bare exit code and no explanation)
- AGENTS.md + README.md: quote the ?ref=production endpoint (zsh globs bare ?)
and fetch via Accept: application/vnd.github.raw instead of jq + base64
(BSD/GNU base64 flag drift)
codecov.yml payload unchanged (byte-frozen to spec Appendix B).
T9078: IS-609
🤖 Generated by [robots](https://vyos.io)
| -rw-r--r-- | .github/workflows/validate.yml | 5 | ||||
| -rw-r--r-- | AGENTS.md | 2 | ||||
| -rw-r--r-- | README.md | 6 |
3 files changed, 6 insertions, 7 deletions
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index f6096b0..4741ea8 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -22,8 +22,7 @@ jobs: - name: Validate codecov.yml structure run: | set -euo pipefail - response=$(curl -sS --fail-with-body -X POST \ + curl -sS --fail-with-body -X POST \ --connect-timeout 10 --max-time 60 \ --data-binary @codecov.yml \ - https://codecov.io/validate) - echo "$response" + https://codecov.io/validate @@ -17,5 +17,5 @@ This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization. 2. Keep `codecov.yml` comment-free — Codecov strips comments on dashboard save; any explanatory content lives here in AGENTS.md or in README.md. 3. After merge to `production`, operator pastes from - `gh api repos/vyos/codecov/contents/codecov.yml?ref=production --jq '.content' | base64 -d` + `gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' -H "Accept: application/vnd.github.raw"` into the dashboard. Repo is the source of truth; dashboard is a cache. @@ -18,8 +18,8 @@ delta is enumerated in the per-org delta table below — never as comments in `c `https://codecov.io/validate`. The check must pass. 3. After merge to `production`: ```bash - gh api repos/vyos/codecov/contents/codecov.yml?ref=production \ - --jq '.content' | base64 -d + gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' \ + -H "Accept: application/vnd.github.raw" ``` Operator pastes this content into the dashboard editor (linked above), saves, and re-opens the tab to confirm the saved content matches. @@ -27,7 +27,7 @@ delta is enumerated in the per-org delta table below — never as comments in `c ## Paste protocol (operator) 1. Open https://app.codecov.io/account/gh/vyos/yaml in browser. -2. Fetch the merged file via `gh api ... | base64 -d` (above). +2. Fetch the merged file via the quoted `gh api` raw-content command (above). 3. Paste into the dashboard editor. 4. Save. 5. Re-open the dashboard tab. **Codecov strips comments** — the saved content |