codecov-action: [v4] `Error: Codecov token not found` in a PR from a fork to a pubilc repo

@jayqi Hello, I have experienced this too. That’s because dependabot is not allowed to read Github Action Secrets based on this documentation. If you put CODECOV_TOKEN in the Github Secret then dependabot definitely won’t be able to read the secret. So that CODECOV_TOKEN can be read by dependabot, you need to put it in Dependabot Secret.

Navigate to the repository settings, then look in the left panel in the “Secrets and variables” section, there is a dropdown option, now you select Dependabot and add CODECOV_TOKEN there. Hope that helps solve your problem.

Me to here https://github.com/kiraware/paspybin/actions/runs/7911211535/job/21595033660. It would be nice if codecov failing the workflow not just passed as everything is ok.

@kiraware Are you passing the param fail_ci_if_error: true?

@carlosmondra nice point, i miss the docs. Thanks for pointing it.

And for everyone, I was surprised because codecov gave the wrong guide, here is an example of the guide I got when setting up a new repo

as you can see, it should using with instead of env. Based on the readme stated

steps:
- uses: actions/checkout@master
- uses: codecov/codecov-action@v4
  with:
    fail_ci_if_error: true # optional (default = false)
    files: ./coverage1.xml,./coverage2.xml # optional
    flags: unittests # optional
    name: codecov-umbrella # optional
    token: ${{ secrets.CODECOV_TOKEN }} # required
    verbose: true # optional (default = false)

and via environment variable

steps:
- uses: actions/checkout@master
- uses: codecov/codecov-action@v4
  with:
    fail_ci_if_error: true # optional (default = false)
    files: ./coverage1.xml,./coverage2.xml # optional
    flags: unittests # optional
    name: codecov-umbrella # optional
    verbose: true # optional (default = false)
  env:
    CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

Again, it was my fault not read the docs. But the guide needs to be fixed soon. Thanks.

Getting the same error in my own public repo when running v4 triggered by a release event on main branch. You can see verbose logs here: https://github.com/georgebv/drf-pydantic/actions/runs/7896620245/job/21550933382

As you can see, re-running (once) didn’t help.

Rolling back to v3 solved this.

https://docs.github.com/en/actions/using-workflows/reusing-workflows#using-inputs-and-secrets-in-a-reusable-workflow

https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets

Note: If you are passing the secret to a nested reusable workflow, then you must use jobs.<job_id>.secrets again to pass the secret. For more information, see “Reusing workflows.”

is there a reason for why we need a token for public repos while we didn’t before? that’s creating a lot of churn/changes

They hit in limits of calling GitHub API required for identifying workflow run. If you upload with a token, they save GitHub API calls. Best will be if they will have higher limit, but it depends on GitHub itself.

is there a reason for why we need a token for public repos while we didn’t before? that’s creating a lot of churn/changes

@JoseLion @clemenscodes if you can open a different issue, while I take a look that would be appreciated. This will help me track better. FWIW @clemenscodes - my understanding is that it looks to be separate from this issue (which is about forks).

Closing this as the original issue is resolved

@jishnub are you able to request the failing run to be re-run just to confirm?

I can confirm re-running the job does not lead to the issue, so it could certainly be a rate limit. It’s just a bit puzzling when jobs fail at random. Perhaps the error message may be improved?