From 0e0ad13beb357b83faffcda48586641ebfd88b7b Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Wed, 12 Aug 2026 21:52:35 +0300 Subject: fix: address adversarial-review findings (validate error visibility + portable paste snippets) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - validate.yml: stream curl output directly; the response=$(...) capture under set -euo pipefail swallowed the validation error body on non-2xx (job failed with a bare exit code and no explanation) - AGENTS.md + README.md: quote the ?ref=production endpoint (zsh globs bare ?) and fetch via Accept: application/vnd.github.raw instead of jq + base64 (BSD/GNU base64 flag drift) codecov.yml payload unchanged (byte-frozen to spec Appendix B). T9078: IS-609 🤖 Generated by [robots](https://vyos.io) --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index f8c0125..1d8a22e 100644 --- a/README.md +++ b/README.md @@ -18,8 +18,8 @@ delta is enumerated in the per-org delta table below — never as comments in `c `https://codecov.io/validate`. The check must pass. 3. After merge to `production`: ```bash - gh api repos/vyos/codecov/contents/codecov.yml?ref=production \ - --jq '.content' | base64 -d + gh api 'repos/vyos/codecov/contents/codecov.yml?ref=production' \ + -H "Accept: application/vnd.github.raw" ``` Operator pastes this content into the dashboard editor (linked above), saves, and re-opens the tab to confirm the saved content matches. @@ -27,7 +27,7 @@ delta is enumerated in the per-org delta table below — never as comments in `c ## Paste protocol (operator) 1. Open https://app.codecov.io/account/gh/vyos/yaml in browser. -2. Fetch the merged file via `gh api ... | base64 -d` (above). +2. Fetch the merged file via the quoted `gh api` raw-content command (above). 3. Paste into the dashboard editor. 4. Save. 5. Re-open the dashboard tab. **Codecov strips comments** — the saved content -- cgit v1.2.3