From df84388ab71239e392837a548a3e1c4d54c4c5de Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Wed, 12 Aug 2026 21:22:12 +0300
Subject: seed: initial Codecov Global YAML + plumbing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bootstrap content for the vyos org Codecov Global YAML mirror. codecov.yml is the
comment-free dashboard-paste payload (Codecov strips comments on save); validate.yml
gates all PRs against https://codecov.io/validate. AGENTS.md + README.md document
the dashboard-paste protocol and language-applicability caveats.

Companion repo: VyOS-Networks/codecov (filed Wave 2, ~1 week soak).
Spec: [VYOS/894337074](https://vyos.atlassian.net/wiki/spaces/VYOS/pages/894337074)
Phorge: T9078
IS: IS-609

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/validate.yml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 .github/workflows/validate.yml

(limited to '.github/workflows')

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 0000000..f6096b0
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,29 @@
+name: validate
+on:
+  pull_request:
+  push:
+    branches: [production]
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Audit egress
+        continue-on-error: true
+        uses: bullfrogsec/bullfrog@7bc9b6e13e2dd9cbe5861f33bc26dc6bdb9d9ed2   # v0.10.0
+        with:
+          egress-policy: audit
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0   # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Validate codecov.yml structure
+        run: |
+          set -euo pipefail
+          response=$(curl -sS --fail-with-body -X POST \
+            --connect-timeout 10 --max-time 60 \
+            --data-binary @codecov.yml \
+            https://codecov.io/validate)
+          echo "$response"
-- 
cgit v1.2.3


From 0e0ad13beb357b83faffcda48586641ebfd88b7b Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Wed, 12 Aug 2026 21:52:35 +0300
Subject: fix: address adversarial-review findings (validate error visibility +
 portable paste snippets)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- validate.yml: stream curl output directly; the response=$(...) capture under
  set -euo pipefail swallowed the validation error body on non-2xx (job failed
  with a bare exit code and no explanation)
- AGENTS.md + README.md: quote the ?ref=production endpoint (zsh globs bare ?)
  and fetch via Accept: application/vnd.github.raw instead of jq + base64
  (BSD/GNU base64 flag drift)

codecov.yml payload unchanged (byte-frozen to spec Appendix B).

T9078: IS-609

🤖 Generated by [robots](https://vyos.io)
---
 .github/workflows/validate.yml | 5 ++---
 AGENTS.md                      | 2 +-
 README.md                      | 6 +++---
 3 files changed, 6 insertions(+), 7 deletions(-)

(limited to '.github/workflows')

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index f6096b0..4741ea8 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -22,8 +22,7 @@ jobs:
       - name: Validate codecov.yml structure
         run: |
           set -euo pipefail
-          response=$(curl -sS --fail-with-body -X POST \
+          curl -sS --fail-with-body -X POST \
             --connect-timeout 10 --max-time 60 \
             --data-binary @codecov.yml \
-            https://codecov.io/validate)
-          echo "$response"
+            https://codecov.io/validate
diff --git a/AGENTS.md b/AGENTS.md
index 8a2dc4c..fc6d9b6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -17,5 +17,5 @@ This repo holds the **Codecov Global YAML** for the `vyos` GitHub organization.
 2. Keep `codecov.yml` comment-free — Codecov strips comments on dashboard save; any
    explanatory content lives here in AGENTS.md or in README.md.
 3. After merge to `production`, operator pastes from
-   `gh api repos/vyos/codecov/contents/codecov.yml?ref=production --jq '.content' | base64 -d`
+   `gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' -H "Accept: application/vnd.github.raw"`
    into the dashboard. Repo is the source of truth; dashboard is a cache.
diff --git a/README.md b/README.md
index f8c0125..1d8a22e 100644
--- a/README.md
+++ b/README.md
@@ -18,8 +18,8 @@ delta is enumerated in the per-org delta table below — never as comments in `c
    `https://codecov.io/validate`. The check must pass.
 3. After merge to `production`:
    ```bash
-   gh api repos/vyos/codecov/contents/codecov.yml?ref=production \
-     --jq '.content' | base64 -d
+   gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' \
+     -H "Accept: application/vnd.github.raw"
    ```
    Operator pastes this content into the dashboard editor (linked above), saves,
    and re-opens the tab to confirm the saved content matches.
@@ -27,7 +27,7 @@ delta is enumerated in the per-org delta table below — never as comments in `c
 ## Paste protocol (operator)
 
 1. Open https://app.codecov.io/account/gh/vyos/yaml in browser.
-2. Fetch the merged file via `gh api ... | base64 -d` (above).
+2. Fetch the merged file via the quoted `gh api` raw-content command (above).
 3. Paste into the dashboard editor.
 4. Save.
 5. Re-open the dashboard tab. **Codecov strips comments** — the saved content
-- 
cgit v1.2.3