feat: allow for authentication via OIDC token (#1330)

* fix: allow for oidc token

* chore(docs): update docs with use_oidc argument

* Update action.yml

Co-authored-by: Cristian Le <github@lecris.me>

* chore(release): 4.2.0

---------

Co-authored-by: Cristian Le <github@lecris.me>

.eslintrc.json

@@ -17,6 +17,7 @@
         "@typescript-eslint"
     ],
     "rules": {
+        "max-len": ["error", { "code": 120 }],
         "linebreak-style": 0
     }
 }

README.md

@@ -64,6 +64,17 @@ steps:
 > [!NOTE]
 > This assumes that you've set your Codecov token inside *Settings > Secrets* as `CODECOV_TOKEN`. If not, you can [get an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) for your specific repo on [codecov.io](https://www.codecov.io). Keep in mind that secrets are *not* available to forks of repositories.
 
+### Using OIDC
+For users with [OpenID Connect(OIDC) enabled](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect), the Codecov token is not necessary. You can use OIDC with the `use_oidc` argument as following.
+
+```yaml
+- uses: codecov/codecov-action@v4
+  with:
+    use_oidc: true
+```
+
+Any token supplied will be ignored, as Codecov will default to the OIDC token for verification.
+
 ## Arguments
 
 Codecov's Action supports inputs from the user. These inputs, along with their descriptions and usage contexts, are listed in the table below:
@@ -99,6 +110,7 @@ Codecov's Action supports inputs from the user. These inputs, along with their d
 | `slug` | Specify the slug manually (Enterprise use) | Optional
 | `url` | Specify the base url to upload (Enterprise use) | Optional
 | `use_legacy_upload_endpoint` | Use the legacy upload endpoint | Optional
+| `use_oidc` | Use OpenID Connect for verification instead of token. This will ignore any token supplied. Please see [GitHub documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for details.
 | `verbose` | Specify whether the Codecov output should be verbose | Optional
 | `version` | Specify which version of the Codecov CLI should be used. Defaults to `latest` | Optional
 | `working-directory` | Directory in which to execute codecov.sh | Optional

action.yml

@@ -95,6 +95,9 @@ inputs:
   use_legacy_upload_endpoint:
     description: 'Use the legacy upload endpoint'
     required: false
+  use_oidc:
+    description: 'Use OIDC instead of token. This will ignore any token supplied'
+    default: false
   verbose:
     description: 'Specify whether the Codecov output should be verbose'
     required: false

dist/index.js

@@ -32452,8 +32452,94 @@ var exec = __nccwpck_require__(1514);
 var core = __nccwpck_require__(2186);
 // EXTERNAL MODULE: ./node_modules/@actions/github/lib/github.js
 var github = __nccwpck_require__(5438);
+;// CONCATENATED MODULE: ./src/helpers.ts
+var __awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+const PLATFORMS = [
+    'linux',
+    'macos',
+    'windows',
+    'alpine',
+    'linux-arm64',
+    'alpine-arm64',
+];
+const setFailure = (message, failCi) => {
+    failCi ? core.setFailed(message) : core.warning(message);
+    if (failCi) {
+        process.exit();
+    }
+};
+const getUploaderName = (platform) => {
+    if (isWindows(platform)) {
+        return 'codecov.exe';
+    }
+    else {
+        return 'codecov';
+    }
+};
+const isValidPlatform = (platform) => {
+    return PLATFORMS.includes(platform);
+};
+const isWindows = (platform) => {
+    return platform === 'windows';
+};
+const getPlatform = (os) => {
+    var _a;
+    if (isValidPlatform(os)) {
+        core.info(`==> ${os} OS provided`);
+        return os;
+    }
+    const platform = (_a = process.env.RUNNER_OS) === null || _a === void 0 ? void 0 : _a.toLowerCase();
+    if (isValidPlatform(platform)) {
+        core.info(`==> ${platform} OS detected`);
+        return platform;
+    }
+    core.info('==> Could not detect OS or provided OS is invalid. Defaulting to linux');
+    return 'linux';
+};
+const getBaseUrl = (platform, version) => {
+    return `https://cli.codecov.io/${version}/${platform}/${getUploaderName(platform)}`;
+};
+const getCommand = (filename, generalArgs, command) => {
+    const fullCommand = [filename, ...generalArgs, command];
+    core.info(`==> Running command '${fullCommand.join(' ')}'`);
+    return fullCommand;
+};
+const setSafeDirectory = () => __awaiter(void 0, void 0, void 0, function* () {
+    const command = ([
+        'git',
+        'config',
+        '--global',
+        '--add',
+        'safe.directory',
+        `${process.env['GITHUB_WORKSPACE']}`,
+    ].join(' '));
+    core.info(`==> Running ${command}`);
+    yield exec.exec(command);
+});
+
+
 ;// CONCATENATED MODULE: ./src/buildExec.ts
 /* eslint-disable  @typescript-eslint/no-explicit-any */
+var buildExec_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
 
 
 const context = github.context;
@@ -32465,14 +32551,32 @@ const isTrue = (variable) => {
         lowercase === 'y' ||
         lowercase === 'yes');
 };
-const buildCommitExec = () => {
+const getToken = () => buildExec_awaiter(void 0, void 0, void 0, function* () {
+    let token = core.getInput('token');
+    let url = core.getInput('url');
+    const useOIDC = isTrue(core.getInput('use_oidc'));
+    if (useOIDC) {
+        if (!url) {
+            url = 'https://codecov.io';
+        }
+        try {
+            token = yield core.getIDToken(url);
+            return token;
+        }
+        catch (err) {
+            setFailure(`Codecov: Failed to get OIDC token with url: ${url}. ${err.message}`, true);
+        }
+    }
+    return token;
+});
+const buildCommitExec = () => buildExec_awaiter(void 0, void 0, void 0, function* () {
     const commitParent = core.getInput('commit_parent');
     const gitService = core.getInput('git_service');
     const overrideBranch = core.getInput('override_branch');
     const overrideCommit = core.getInput('override_commit');
     const overridePr = core.getInput('override_pr');
     const slug = core.getInput('slug');
-    const token = core.getInput('token');
+    const token = yield getToken();
     const failCi = isTrue(core.getInput('fail_ci_if_error'));
     const workingDir = core.getInput('working-directory');
     const commitCommand = 'create-commit';
@@ -32519,7 +32623,7 @@ const buildCommitExec = () => {
         commitOptions.cwd = workingDir;
     }
     return { commitExecArgs, commitOptions, commitCommand };
-};
+});
 const buildGeneralExec = () => {
     const codecovYmlPath = core.getInput('codecov_yml_path');
     const url = core.getInput('url');
@@ -32536,12 +32640,12 @@ const buildGeneralExec = () => {
     }
     return { args, verbose };
 };
-const buildReportExec = () => {
+const buildReportExec = () => buildExec_awaiter(void 0, void 0, void 0, function* () {
     const gitService = core.getInput('git_service');
     const overrideCommit = core.getInput('override_commit');
     const overridePr = core.getInput('override_pr');
     const slug = core.getInput('slug');
-    const token = core.getInput('token');
+    const token = yield getToken();
     const failCi = isTrue(core.getInput('fail_ci_if_error'));
     const workingDir = core.getInput('working-directory');
     const reportCommand = 'create-report';
@@ -32582,8 +32686,8 @@ const buildReportExec = () => {
         reportOptions.cwd = workingDir;
     }
     return { reportExecArgs, reportOptions, reportCommand };
-};
+});
-const buildUploadExec = () => {
+const buildUploadExec = () => buildExec_awaiter(void 0, void 0, void 0, function* () {
     const disableFileFixes = isTrue(core.getInput('disable_file_fixes'));
     const disableSafeDirectory = isTrue(core.getInput('disable_safe_directory'));
     const disableSearch = isTrue(core.getInput('disable_search'));
@@ -32610,7 +32714,7 @@ const buildUploadExec = () => {
     const rootDir = core.getInput('root_dir');
     const searchDir = core.getInput('directory');
     const slug = core.getInput('slug');
-    const token = core.getInput('token');
+    const token = yield getToken();
     let uploaderVersion = core.getInput('version');
     const useLegacyUploadEndpoint = isTrue(core.getInput('use_legacy_upload_endpoint'));
     const workingDir = core.getInput('working-directory');
@@ -32737,82 +32841,6 @@ const buildUploadExec = () => {
         uploaderVersion,
         uploadCommand,
     };
-};
-
-
-;// CONCATENATED MODULE: ./src/helpers.ts
-var __awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-
-
-const PLATFORMS = [
-    'linux',
-    'macos',
-    'windows',
-    'alpine',
-    'linux-arm64',
-    'alpine-arm64',
-];
-const setFailure = (message, failCi) => {
-    failCi ? core.setFailed(message) : core.warning(message);
-    if (failCi) {
-        process.exit();
-    }
-};
-const getUploaderName = (platform) => {
-    if (isWindows(platform)) {
-        return 'codecov.exe';
-    }
-    else {
-        return 'codecov';
-    }
-};
-const isValidPlatform = (platform) => {
-    return PLATFORMS.includes(platform);
-};
-const isWindows = (platform) => {
-    return platform === 'windows';
-};
-const getPlatform = (os) => {
-    var _a;
-    if (isValidPlatform(os)) {
-        core.info(`==> ${os} OS provided`);
-        return os;
-    }
-    const platform = (_a = process.env.RUNNER_OS) === null || _a === void 0 ? void 0 : _a.toLowerCase();
-    if (isValidPlatform(platform)) {
-        core.info(`==> ${platform} OS detected`);
-        return platform;
-    }
-    core.info('==> Could not detect OS or provided OS is invalid. Defaulting to linux');
-    return 'linux';
-};
-const getBaseUrl = (platform, version) => {
-    return `https://cli.codecov.io/${version}/${platform}/${getUploaderName(platform)}`;
-};
-const getCommand = (filename, generalArgs, command) => {
-    const fullCommand = [filename, ...generalArgs, command];
-    core.info(`==> Running command '${fullCommand.join(' ')}'`);
-    return fullCommand;
-};
-const setSafeDirectory = () => __awaiter(void 0, void 0, void 0, function* () {
-    const command = ([
-        'git',
-        'config',
-        '--global',
-        '--add',
-        'safe.directory',
-        `${process.env['GITHUB_WORKSPACE']}`,
-    ].join(' '));
-    core.info(`==> Running ${command}`);
-    yield exec.exec(command);
 });
 
 
@@ -32957,10 +32985,11 @@ var src_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _argu
 
 
 let failCi;
-try {
+const run = () => src_awaiter(void 0, void 0, void 0, function* () {
-    const { commitExecArgs, commitOptions, commitCommand } = buildCommitExec();
+    try {
-    const { reportExecArgs, reportOptions, reportCommand } = buildReportExec();
+        const { commitExecArgs, commitOptions, commitCommand } = yield buildCommitExec();
-    const { uploadExecArgs, uploadOptions, disableSafeDirectory, failCi, os, uploaderVersion, uploadCommand, } = buildUploadExec();
+        const { reportExecArgs, reportOptions, reportCommand } = yield buildReportExec();
+        const { uploadExecArgs, uploadOptions, disableSafeDirectory, failCi, os, uploaderVersion, uploadCommand, } = yield buildUploadExec();
         const { args, verbose } = buildGeneralExec();
         const platform = getPlatform(os);
         const filename = external_path_.join(__dirname, getUploaderName(platform));
@@ -33015,10 +33044,12 @@ try {
                 });
             }));
         });
-}
+    }
-catch (err) {
+    catch (err) {
         setFailure(`Codecov: Encountered an unexpected error ${err.message}`, failCi);
-}
+    }
+});
+run();
 
 })();
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "codecov-action",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "codecov-action",
-      "version": "4.1.1",
+      "version": "4.2.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecov-action",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "Upload coverage reports to Codecov from GitHub Actions",
   "main": "index.js",
   "scripts": {

src/buildExec.test.ts

@@ -10,7 +10,7 @@ import {
 
 const context = github.context;
 
-test('general args', () => {
+test('general args', async () => {
   const envs = {
     codecov_yml_path: 'dev/codecov.yml',
     url: 'https://codecov.enterprise.com',
@@ -20,7 +20,7 @@ test('general args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {args, verbose} = buildGeneralExec();
+  const {args, verbose} = await buildGeneralExec();
 
   expect(args).toEqual(
       expect.arrayContaining([
@@ -36,13 +36,12 @@ test('general args', () => {
   }
 });
 
-
+test('upload args using context', async () => {
-test('upload args using context', () => {
   const expectedArgs = [
     '--git-service',
     'github',
   ];
-  const {uploadExecArgs, uploadCommand} = buildUploadExec();
+  const {uploadExecArgs, uploadCommand} = await buildUploadExec();
   if (context.eventName == 'pull_request') {
     expectedArgs.push('-C', `${context.payload.pull_request.head.sha}`);
   }
@@ -54,7 +53,7 @@ test('upload args using context', () => {
   expect(uploadCommand).toEqual('do-upload');
 });
 
-test('upload args', () => {
+test('upload args', async () => {
   const envs = {
     'codecov_yml_path': 'dev/codecov.yml',
     'commit_parent': 'fakeparentcommit',
@@ -94,7 +93,7 @@ test('upload args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {uploadExecArgs, uploadCommand} = buildUploadExec();
+  const {uploadExecArgs, uploadCommand} = await buildUploadExec();
   const expectedArgs = [
     '--disable-file-fixes',
     '--disable-search',
@@ -156,7 +155,7 @@ test('upload args', () => {
 });
 
 
-test('report args', () => {
+test('report args', async () => {
   const envs = {
     git_service: 'github_enterprise',
     override_commit: '9caabca5474b49de74ef5667deabaf74cdacc244',
@@ -169,7 +168,7 @@ test('report args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {reportExecArgs, reportCommand} = buildReportExec();
+  const {reportExecArgs, reportCommand} = await buildReportExec();
 
   const expectedArgs = [
     '--git-service',
@@ -191,7 +190,7 @@ test('report args', () => {
 });
 
 
-test('report args using context', () => {
+test('report args using context', async () => {
   const envs = {
     token: 'd3859757-ab80-4664-924d-aef22fa7557b',
   };
@@ -206,7 +205,7 @@ test('report args using context', () => {
     expectedArgs.push('-C', `${context.payload.pull_request.head.sha}`);
   }
 
-  const {reportExecArgs, reportCommand} = buildReportExec();
+  const {reportExecArgs, reportCommand} = await buildReportExec();
 
   expect(reportExecArgs).toEqual(expectedArgs);
   expect(reportCommand).toEqual('create-report');
@@ -216,7 +215,7 @@ test('report args using context', () => {
 });
 
 
-test('commit args', () => {
+test('commit args', async () => {
   const envs = {
     git_service: 'github_enterprise',
     commit_parent: '83231650328f11695dfb754ca0f540516f188d27',
@@ -231,7 +230,7 @@ test('commit args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {commitExecArgs, commitCommand} = buildCommitExec();
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
   const expectedArgs = [
     '--parent-sha',
     '83231650328f11695dfb754ca0f540516f188d27',
@@ -255,13 +254,13 @@ test('commit args', () => {
   }
 });
 
-test('commit args using context', () => {
+test('commit args using context', async () => {
   const expectedArgs :string[] = [
     '--git-service',
     'github',
   ];
 
-  const {commitExecArgs, commitCommand} = buildCommitExec();
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
   if (context.eventName == 'pull_request') {
     expectedArgs.push('-C', `${context.payload.pull_request.head.sha}`);
   }

src/buildExec.ts

@@ -3,6 +3,7 @@
 import * as core from '@actions/core';
 import * as github from '@actions/github';
 
+import {setFailure} from './helpers';
 
 const context = github.context;
 
@@ -17,15 +18,36 @@ const isTrue = (variable) => {
   );
 };
 
+const getToken = async () => {
+  let token = core.getInput('token');
+  let url = core.getInput('url');
+  const useOIDC = isTrue(core.getInput('use_oidc'));
 
-const buildCommitExec = () => {
+  if (useOIDC) {
+    if (!url) {
+      url = 'https://codecov.io';
+    }
+    try {
+      token = await core.getIDToken(url);
+      return token;
+    } catch (err) {
+      setFailure(
+          `Codecov: Failed to get OIDC token with url: ${url}. ${err.message}`,
+          true,
+      );
+    }
+  }
+  return token;
+};
+
+const buildCommitExec = async () => {
   const commitParent = core.getInput('commit_parent');
   const gitService = core.getInput('git_service');
   const overrideBranch = core.getInput('override_branch');
   const overrideCommit = core.getInput('override_commit');
   const overridePr = core.getInput('override_pr');
   const slug = core.getInput('slug');
-  const token = core.getInput('token');
+  const token = await getToken();
   const failCi = isTrue(core.getInput('fail_ci_if_error'));
   const workingDir = core.getInput('working-directory');
 
@@ -101,12 +123,12 @@ const buildGeneralExec = () => {
   return {args, verbose};
 };
 
-const buildReportExec = () => {
+const buildReportExec = async () => {
   const gitService = core.getInput('git_service');
   const overrideCommit = core.getInput('override_commit');
   const overridePr = core.getInput('override_pr');
   const slug = core.getInput('slug');
-  const token = core.getInput('token');
+  const token = await getToken();
   const failCi = isTrue(core.getInput('fail_ci_if_error'));
   const workingDir = core.getInput('working-directory');
 
@@ -158,7 +180,7 @@ const buildReportExec = () => {
   return {reportExecArgs, reportOptions, reportCommand};
 };
 
-const buildUploadExec = () => {
+const buildUploadExec = async () => {
   const disableFileFixes = isTrue(core.getInput('disable_file_fixes'));
   const disableSafeDirectory = isTrue(core.getInput('disable_safe_directory'));
   const disableSearch = isTrue(core.getInput('disable_search'));
@@ -185,7 +207,7 @@ const buildUploadExec = () => {
   const rootDir = core.getInput('root_dir');
   const searchDir = core.getInput('directory');
   const slug = core.getInput('slug');
-  const token = core.getInput('token');
+  const token = await getToken();
   let uploaderVersion = core.getInput('version');
   const useLegacyUploadEndpoint = isTrue(
       core.getInput('use_legacy_upload_endpoint'),

src/index.ts

@@ -24,9 +24,10 @@ import versionInfo from './version';
 
 let failCi;
 
-try {
+const run = async () => {
-  const {commitExecArgs, commitOptions, commitCommand} = buildCommitExec();
+  try {
-  const {reportExecArgs, reportOptions, reportCommand} = buildReportExec();
+    const {commitExecArgs, commitOptions, commitCommand} = await buildCommitExec();
+    const {reportExecArgs, reportOptions, reportCommand} = await buildReportExec();
     const {
       uploadExecArgs,
       uploadOptions,
@@ -35,7 +36,7 @@ try {
       os,
       uploaderVersion,
       uploadCommand,
-  } = buildUploadExec();
+    } = await buildUploadExec();
     const {args, verbose} = buildGeneralExec();
 
     const platform = getPlatform(os);
@@ -120,6 +121,9 @@ try {
                 });
           });
     });
-} catch (err) {
+  } catch (err) {
     setFailure(`Codecov: Encountered an unexpected error ${err.message}`, failCi);
-}
+  }
+};
+
+run();