chore(release):4.6.0 (#1587)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.7 to 4.2.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4.1.7...v4.2.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.eslintrc.json

@@ -17,6 +17,7 @@
         "@typescript-eslint"
     ],
     "rules": {
+        "max-len": ["error", { "code": 120 }],
         "linebreak-style": 0
     }
 }

.github/workflows/codeql-analysis.yml

@@ -12,10 +12,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main ]
   schedule:
     - cron: '24 6 * * 5'
 
@@ -37,11 +37,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4.2.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3.26.9
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -52,7 +52,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3.26.9
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -66,4 +66,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3.26.9

.github/workflows/enforce-license-compliance.yml

@@ -0,0 +1,14 @@
+name: Enforce License Compliance
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  enforce-license-compliance:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Enforce License Compliance'
+        uses: getsentry/action-enforce-license-compliance@57ba820387a1a9315a46115ee276b2968da51f3d # main
+        with:
+          fossa_api_key: ${{ secrets.FOSSA_API_KEY }}

.github/workflows/main.yml

@@ -1,38 +1,6 @@
 name: Workflow for Codecov Action
 on: [push, pull_request]
 jobs:
-  no-deps:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Upload coverage to Codecov (script)
-        uses: ./
-        with:
-          files: ./coverage/script/coverage-final.json
-          flags: script,${{ matrix.os }}
-          name: codecov-script
-          verbose: true
-      - name: Upload coverage to Codecov (demo)
-        uses: ./
-        with:
-          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
-          file: ./coverage/coverage-final.json
-          flags: demo,${{ matrix.os }}
-          name: codecov-demo
-          verbose: true
-      - name: Upload coverage to Codecov (version)
-        uses: ./
-        with:
-          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
-          file: ./coverage/coverage-final.json
-          flags: version,${{ matrix.os }}
-          name: codecov-version
-          version: v0.1.0_8880
-          verbose: true
   run:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -40,7 +8,93 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4.2.0
+      - name: Install dependencies
+        run: npm install
+      - name: Lint
+        run: npm run lint
+      - name: Run tests and collect coverage
+        run: npm run test
+      - name: Upload coverage to Codecov (script)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/script/coverage-final.json
+          flags: script,${{ matrix.os }}
+          name: codecov-script
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (demo)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
+          file: ./coverage/coverage-final.json
+          flags: demo,${{ matrix.os }}
+          name: codecov-demo
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (version)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
+          file: ./coverage/coverage-final.json
+          flags: version,${{ matrix.os }}
+          name: codecov-version
+          version: v0.7.3
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  run-macos-latest-xlarge:
+    if: github.head.repo.full_name == 'codecov/codecov-action'
+    runs-on: macos-latest-xlarge
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.0
+      - name: Install dependencies
+        run: npm install
+      - name: Lint
+        run: npm run lint
+      - name: Run tests and collect coverage
+        run: npm run test
+      - name: Upload coverage to Codecov (script)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/script/coverage-final.json
+          flags: script,macos-latest-xlarge
+          name: codecov-script
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (demo)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
+          file: ./coverage/coverage-final.json
+          flags: demo,macos-latest-xlarge
+          name: codecov-demo
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (version)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
+          file: ./coverage/coverage-final.json
+          flags: version,maxos-latest-xlarge
+          name: codecov-version
+          version: v0.6.0
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  run-container:
+    runs-on: ubuntu-latest
+    container: node:18
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.2.0
       - name: Install dependencies
         run: npm install
       - name: Lint
@@ -54,6 +108,7 @@ jobs:
           flags: script,${{ matrix.os }}
           name: codecov-script
           verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload coverage to Codecov (demo)
         uses: ./
         with:
@@ -62,6 +117,7 @@ jobs:
           flags: demo,${{ matrix.os }}
           name: codecov-demo
           verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload coverage to Codecov (version)
         uses: ./
         with:
@@ -69,5 +125,6 @@ jobs:
           file: ./coverage/coverage-final.json
           flags: version,${{ matrix.os }}
           name: codecov-version
-          version: v0.1.0_8880
+          version: v0.6.0
           verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/scorecards-analysis.yml

@@ -5,13 +5,14 @@ on:
   schedule:
     - cron: '43 20 * * 1'
   push:
-    branches: [ master ]
+    branches: [ main ]
 
 # Declare default permissions as read only.
 permissions: read-all
 
 jobs:
   analysis:
+    if: github.repository == 'codecov/codecov-action'
     name: Scorecards analysis
     runs-on: ubuntu-latest
     permissions:
@@ -21,15 +22,15 @@ jobs:
       id-token: write
       actions: read
       contents: read
-    
+
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # v3.0.0
+        uses: actions/checkout@v4.2.0 # v3.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@80e868c13c90f172d68d1f4501dee99e2479f7af # v2.1.3
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -40,22 +41,22 @@ jobs:
           # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }}
 
           # Publish the results for public repositories to enable scorecard badges. For more details, see
-          # https://github.com/ossf/scorecard-action#publishing-results. 
+          # https://github.com/ossf/scorecard-action#publishing-results.
-          # For private repositories, `publish_results` will automatically be set to `false`, regardless 
+          # For private repositories, `publish_results` will automatically be set to `false`, regardless
           # of the value entered here.
           publish_results: true
 
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
-      
+
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@5f532563584d71fdef14ee64d17bafb34f751ce5 # v1.0.26
+        uses: github/codeql-action/upload-sarif@v3.26.9 # v1.0.26
         with:
           sarif_file: results.sarif

CHANGELOG.md

@@ -1,3 +1,16 @@
+## 4.0.0-beta.2
+### Fixes
+- #1085 not adding -n if empty to do-upload command
+
+## 4.0.0-beta.1
+
+`v4` represents a move from the [universal uploader](https://github.com/codecov/uploader) to the [Codecov CLI](https://github.com/codecov/codecov-cli). Although this will unlock new features for our users, the CLI is not yet at feature parity with the universal uploader.
+
+### Breaking Changes
+- No current support for `aarch64` and `alpine` architectures.
+- Tokenless uploading is unsuported
+- Various arguments to the Action have been removed
+
 ## 3.1.4
 ### Fixes
 - #967 Fix typo in README.md

Makefile

@@ -1,7 +1,7 @@
 deploy:
 	$(eval VERSION := $(shell cat package.json | grep '"version": ' | cut -d\" -f4))
-	git tag -d v3
+	git tag -d v4
-	git push origin :v3
+	git push origin :v4
-	git tag v3
+	git tag v4
 	git tag v$(VERSION) -s -m ""
 	git push origin --tags

README.md

@@ -1,94 +1,119 @@
 # Codecov GitHub Action
 
-[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-v3-undefined.svg?logo=github&logoColor=white&style=flat)](https://github.com/marketplace/actions/codecov)
+[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-v4-undefined.svg?logo=github&logoColor=white&style=flat)](https://github.com/marketplace/actions/codecov)
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fcodecov%2Fcodecov-action.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Fcodecov%2Fcodecov-action?ref=badge_shield)
 [![Workflow for Codecov Action](https://github.com/codecov/codecov-action/actions/workflows/main.yml/badge.svg)](https://github.com/codecov/codecov-action/actions/workflows/main.yml)
 ### Easily upload coverage reports to Codecov from GitHub Actions
 
->The latest release of this Action adds support for tokenless uploads from GitHub Actions!
+## v4 Release
+`v4` of the Codecov GitHub Action will use the [Codecov CLI](https://github.com/codecov/codecov-cli) to upload coverage reports to Codecov.
 
-## ⚠️  Deprecation of v1
+### Breaking Changes
-**As of February 1, 2022, v1 has been fully sunset and no longer functions**
+- Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OSS projects do not need the upstream repo's Codecov token). For details, [see our docs](https://docs.codecov.com/docs/codecov-uploader#supporting-token-less-uploads-for-forks-of-open-source-repos-using-codecov)
+- Various arguments to the Action have been removed
 
-Due to the [deprecation](https://about.codecov.io/blog/introducing-codecovs-new-uploader/) of the underlying bash uploader,
+### Dependabot
-the Codecov GitHub Action has released `v2`/`v3` which will use the new [uploader](https://github.com/codecov/uploader). You can learn
+- For repositories using `Dependabot`, users will need to ensure that it has access to the Codecov token for PRs from Dependabot to upload coverage. To do this, please add your `CODECOV_TOKEN` as a Dependabot Secret. For more information, see ["Configuring access to private registries for Dependabot."](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#storing-credentials-for-dependabot-to-use)
-more about our deprecation plan and the new uploader on our [blog](https://about.codecov.io/blog/introducing-codecovs-new-uploader/).
 
-We will be restricting any updates to the `v1` Action to security updates and hotfixes.
+`v3` versions and below will not have access to CLI features (e.g. global upload token, ATS).
-
-### Migration from `v1` to `v3`
-The `v3` uploader has a few breaking changes for users
-- Multiple fields have not been transferred from the bash uploader or have been deprecated. Notably
-many of the `functionalities` and `gcov_` arguments have been removed. Please check the documentation
-below for the full list.
 
 ## Usage
 
-To integrate Codecov with your Actions pipeline, specify the name of this repository with a tag number (`@v3` is recommended) as a `step` within your `workflow.yml` file.
+To integrate Codecov with your Actions pipeline, specify the name of this repository with a tag number (`@v4` is recommended) as a `step` within your `workflow.yml` file.
 
-If you have a *private repository*, this Action also requires you to [provide an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) from [codecov.io](https://www.codecov.io) (tip: in order to avoid exposing your token, store it as a `secret`). Optionally, you can choose to include up to four additional inputs to customize the upload context. **For public repositories, no token is needed**
+This Action also requires you to [provide an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) from [codecov.io](https://www.codecov.io) (tip: in order to avoid exposing your token, [store it](https://docs.codecov.com/docs/adding-the-codecov-token#github-actions) as a `secret`).
+
+Currently, the Action will identify linux, macos, and windows runners. However, the Action may misidentify other architectures. The OS can be specified as
+- alpine
+- alpine-arm64
+- linux
+- linux-arm64
+- macos
+- windows
 
 Inside your `.github/workflows/workflow.yml` file:
 
 ```yaml
 steps:
-- uses: actions/checkout@master
+- uses: actions/checkout@main
-- uses: codecov/codecov-action@v3
+- uses: codecov/codecov-action@v4
   with:
-    token: ${{ secrets.CODECOV_TOKEN }}
+    fail_ci_if_error: true # optional (default = false)
     files: ./coverage1.xml,./coverage2.xml # optional
     flags: unittests # optional
     name: codecov-umbrella # optional
-    fail_ci_if_error: true # optional (default = false)
+    token: ${{ secrets.CODECOV_TOKEN }} # required
     verbose: true # optional (default = false)
 ```
->**Note**: This assumes that you've set your Codecov token inside *Settings > Secrets* as `CODECOV_TOKEN`. If not, you can [get an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) for your specific repo on [codecov.io](https://www.codecov.io). Keep in mind that secrets are *not* available to forks of repositories.
+
+The Codecov token can also be passed in via environment variables:
+
+```yaml
+steps:
+- uses: actions/checkout@main
+- uses: codecov/codecov-action@v4
+  with:
+    fail_ci_if_error: true # optional (default = false)
+    files: ./coverage1.xml,./coverage2.xml # optional
+    flags: unittests # optional
+    name: codecov-umbrella # optional
+    verbose: true # optional (default = false)
+  env:
+    CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+```
+> [!NOTE]
+> This assumes that you've set your Codecov token inside *Settings > Secrets* as `CODECOV_TOKEN`. If not, you can [get an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) for your specific repo on [codecov.io](https://www.codecov.io). Keep in mind that secrets are *not* available to forks of repositories.
+
+### Using OIDC
+For users with [OpenID Connect(OIDC) enabled](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect), the Codecov token is not necessary. You can use OIDC with the `use_oidc` argument as following.
+
+```yaml
+- uses: codecov/codecov-action@v4
+  with:
+    use_oidc: true
+```
+
+Any token supplied will be ignored, as Codecov will default to the OIDC token for verification.
 
 ## Arguments
 
 Codecov's Action supports inputs from the user. These inputs, along with their descriptions and usage contexts, are listed in the table below:
 
-| Input  | Description | Usage |
+| Input  | Description | Required |
-| :---:     |     :---:   |    :---:   |
+| :---       |     :---     |    :---:   |
-| `token`  | Used to authorize coverage report uploads  | *Required |
+| `token` | Repository Codecov token. Used to authorize report uploads | *Required
-| `move_coverage_to_trash` | Move discovered coverage reports to the trash | Optional
+| `codecov_yml_path` | Specify the path to the Codecov YML | Optional
-| `commit_parent` | The commit SHA of the parent for which you are uploading coverage. If not present, the parent will be determined using the API of your repository provider.  When using the repository provider's API, the parent is determined via finding the closest ancestor to the commit. | Optional
+| `commit_parent` | Override to specify the parent commit SHA | Optional
+| `directory` | Directory to search for coverage reports. | Optional
+| `disable_search` | Disable search for coverage files. This is helpful when specifying what files you want to upload with the --file option. | Optional
+| `disable_file_fixes` | Disable file fixes to ignore common lines from coverage (e.g. blank lines or empty brackets) | Optional
 | `dry_run` | Don't upload files to Codecov | Optional
-| `env_vars`  | Environment variables to tag the upload with. Multiple env variables can be separated with commas (e.g. `OS,PYTHON`) | Optional
+| `env_vars` | Environment variables to tag the upload with (e.g. PYTHON \| OS,PYTHON) | Optional
-| `fail_ci_if_error`  | Specify if CI pipeline should fail when Codecov runs into errors during upload. *Defaults to **false*** | Optional
+| `exclude` | Folders to exclude from search | Optional
-| `files`  | Comma-separated paths to the coverage report(s). Negated paths are supported by starting with `!` | Optional
+| `fail_ci_if_error` | Specify whether or not CI build should fail if Codecov runs into an error during upload | Optional
-| `flags`  | Flag the upload to group coverage metrics (unittests, uitests, etc.). Multiple flags are separated by a comma (ui,chrome) | Optional
+| `file` | Path to coverage file to upload | Optional
-| `full_report` | Specify the path of a full Codecov report to re-upload | Optional
+| `files` | Comma-separated list of files to upload | Optional
-| `functionalities` | Toggle functionalities | Optional
+| `flags` | Flag upload to group coverage metrics (e.g. unittests \| integration \| ui,chrome) | Optional
-| -- `network` | Disable uploading the file network | Optional
+| `handle_no_reports_found` | Raise no exceptions when no coverage reports found | Optional
-| -- `fixes` | Enable file fixes to ignore common lines from coverage | Optional
+| `job_code` | The job code | Optional
-| -- `search` | Disable searching for coverage files | Optional
+| `name` | User defined upload name. Visible in Codecov UI | Optional
-| `gcov` | Run with gcov support | Optional
+| `os` | Override the assumed OS. Options are linux \| macos \| windows \| . | Optional
-| `gcov_args` | Extra arguments to pass to gcov | Optional
-| `gcov_ignore` | Paths to ignore during gcov gathering | Optional
-| `gcov_include` | Paths to include during gcov gathering | Optional
-| `gcov_executable` | gcov executable to run. Defaults to gcov. | Optional
-| `name`  | Custom defined name for the upload | Optional
-| `network_filter` | Specify a filter on the files listed in the network section of the Codecov report. Useful for upload-specific path fixing | Optional
-| `network_prefix` | Specify a prefix on files listed in the network section of the Codecov report. Useful to help resolve path fixing | Optional
-| `os` | Specify the OS (linux, macos, windows, alpine) | Optional
 | `override_branch` | Specify the branch name | Optional
 | `override_build` | Specify the build number | Optional
+| `override_build_url` | The URL of the build where this is running | Optional
 | `override_commit` | Specify the commit SHA | Optional
 | `override_pr` | Specify the pull request number | Optional
-| `override_tag` | Specify the git tag | Optional
+| `plugin` | plugins to run. Options: xcode, gcov, pycoverage. The default behavior runs them all. | Optional
-| `root_dir` | Used when not in git/hg project to identify project root directory | Optional
+| `plugins` | Comma-separated list of plugins for use during upload. | Optional
-| `directory` | Directory to search for coverage reports. | Optional
+| `report_code` | The code of the report. If unsure, do not include | Optional
+| `root_dir` | Used to specify the location of your   .git   root to identify project root directory | Optional
 | `slug` | Specify the slug manually (Enterprise use) | Optional
-| `swift` | Run with swift coverage support | Optional
+| `url` | Specify the base url to upload (Enterprise use) | Optional
-| -- `swift_project` | Specify the swift project to speed up coverage conversion | Optional
+| `use_legacy_upload_endpoint` | Use the legacy upload endpoint | Optional
-| `upstream_proxy` | The upstream http proxy server to connect through | Optional
+| `use_oidc` | Use OpenID Connect for verification instead of token. This will ignore any token supplied. Please see [GitHub documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for details.
-| `url` | Change the upload host (Enterprise use) | Optional
 | `verbose` | Specify whether the Codecov output should be verbose | Optional
-| `version` | Specify which version of the Codecov Uploader should be used. Defaults to `latest` | Optional
+| `version` | Specify which version of the Codecov CLI should be used. Defaults to `latest` | Optional
-| `working-directory` | Directory in which to execute `codecov.sh` | Optional
+| `working-directory` | Directory in which to execute codecov.sh | Optional
-| `xtra_args` | Add additional uploader args that may be missing in the Action | Optional
-
 
 ### Example `workflow.yml` with Codecov Action
 
@@ -105,9 +130,9 @@ jobs:
       OS: ${{ matrix.os }}
       PYTHON: '3.10'
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@main
     - name: Setup Python
-      uses: actions/setup-python@master
+      uses: actions/setup-python@main
       with:
         python-version: 3.10
     - name: Generate coverage report
@@ -116,15 +141,15 @@ jobs:
         pip install pytest-cov
         pytest --cov=./ --cov-report=xml
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v3
+      uses: codecov/codecov-action@v4
       with:
-        token: ${{ secrets.CODECOV_TOKEN }}
         directory: ./coverage/reports/
         env_vars: OS,PYTHON
         fail_ci_if_error: true
         files: ./coverage1.xml,./coverage2.xml,!./cache
         flags: unittests
         name: codecov-umbrella
+        token: ${{ secrets.CODECOV_TOKEN }}
         verbose: true
 ```
 ## Contributing

action.yml

@@ -3,25 +3,25 @@ description: 'GitHub Action that uploads coverage reports for your repository to
 author: 'Ibrahim Ali <@ibrahim0814> & Thomas Hu <@thomasrockhu> | Codecov'
 inputs:
   token:
-    description: 'Repository upload token - get it from codecov.io. Required only for private repositories'
+    description: 'Repository Codecov token. Used to authorize report uploads'
     required: false
-  file:
+  codecov_yml_path:
-    description: 'Path to coverage file to upload'
+    description: 'Specify the path to the Codecov YML'
     required: false
-  files:
+  commit_parent:
-    description: 'Comma-separated list of files to upload'
+    description: 'Override to specify the parent commit SHA'
     required: false
   directory:
     description: 'Directory to search for coverage reports.'
     required: false
-  flags:
+  disable_file_fixes:
-    description: 'Flag upload to group coverage metrics (e.g. unittests | integration | ui,chrome)'
+    description: 'Disable file fixes to ignore common lines from coverage (e.g. blank lines or empty brackets)'
     required: false
-  full_report:
+  disable_search:
-    description: Specify the path of a full Codecov report to re-upload
+    description: 'Disable search for coverage files. This is helpful when specifying what files you want to upload with the --file option.'
     required: false
-  commit_parent:
+  disable_safe_directory:
-    description: 'The commit SHA of the parent for which you are uploading coverage. If not present, the parent will be determined using the API of your repository provider.  When using the repository providers API, the parent is determined via finding the closest ancestor to the commit.'
+    description: 'Disable setting safe directory. Set to true to disable.'
     required: false
   dry_run:
     description: "Don't upload files to Codecov"
@@ -29,41 +29,41 @@ inputs:
   env_vars:
     description: 'Environment variables to tag the upload with (e.g. PYTHON | OS,PYTHON)'
     required: false
+  exclude:
+    description: 'Folders to exclude from search'
+    required: false
   fail_ci_if_error:
     description: 'Specify whether or not CI build should fail if Codecov runs into an error during upload'
     required: false
-  functionalities:
+  file:
-    description: 'Comma-separated list, see the README for options and their usage. Options include `network`, `fixes`, `search`.'
+    description: 'Path to coverage file to upload'
     required: false
-  gcov:
+  files:
-    description: 'Run with gcov support'
+    description: 'Comma-separated list of files to upload'
     required: false
-  gcov_args:
+  flags:
-    description: 'Extra arguments to pass to gcov'
+    description: 'Flag upload to group coverage metrics (e.g. unittests | integration | ui,chrome)'
     required: false
-  gcov_executable:
+  git_service:
-    description: 'gcov executable to run. Defaults to gcov'
+    description: 'Override the git_service (e.g. github_enterprise)'
     required: false
-  gcov_ignore:
+  handle_no_reports_found:
-    description: 'Paths to ignore during gcov gathering'
+    description: 'Raise no exceptions when no coverage reports found'
     required: false
-  gcov_include:
+  job_code:
-    description: 'Paths to include during gcov gathering'
+    description: 'The job code'
-    required: false
-  move_coverage_to_trash:
-    description: 'Move discovered coverage reports to the trash'
     required: false
   name:
     description: 'User defined upload name. Visible in Codecov UI'
     required: false
   network_filter:
-    description: 'Specify a filter on the files listed in the network section of the Codecov report. Useful for upload-specific path fixing'
+    description: 'Specify a filter on the files listed in the network section of the Codecov report. This will only add files whose path begin with the specified filter. Useful for upload-specific path fixing'
     required: false
   network_prefix:
     description: 'Specify a prefix on files listed in the network section of the Codecov report. Useful to help resolve path fixing'
     required: false
   os:
-    description: 'Override the assumed OS. Options are aarch64 | alpine | linux | macos | windows.'
+    description: 'Override the assumed OS. Options are linux | macos | windows.'
     required: false
   override_branch:
     description: 'Specify the branch name'
@@ -71,14 +71,23 @@ inputs:
   override_build:
     description: 'Specify the build number'
     required: false
+  override_build_url:
+    description: 'The URL of the build where this is running'
+    required: false
   override_commit:
     description: 'Specify the commit SHA'
     required: false
   override_pr:
     description: 'Specify the pull request number'
     required: false
-  override_tag:
+  plugin:
-    description: 'Specify the git tag'
+    description: 'plugins to run. Options: xcode, gcov, pycoverage. The default behavior runs them all.'
+    required: false
+  plugins:
+    description: 'Comma-separated list of plugins for use during upload.'
+    required: false
+  report_code:
+    description: 'The code of the report. If unsure, do not include'
     required: false
   root_dir:
     description: 'Used when not in git/hg project to identify project root directory'
@@ -86,39 +95,27 @@ inputs:
   slug:
     description: 'Specify the slug manually (Enterprise use)'
     required: false
-  swift:
-    description: 'Run with swift coverage support'
-    required: false
-  swift_project:
-    description: 'Specify the swift project to speed up coverage conversion'
-    required: false
-  upstream_proxy:
-    description: 'The upstream http proxy server to connect through'
-    required: false
   url:
-    description: 'Change the upload host (Enterprise use)'
+    description: 'Specify the base url to upload (Enterprise use)'
+    required: false
+  use_legacy_upload_endpoint:
+    description: 'Use the legacy upload endpoint'
+    required: false
+  use_oidc:
+    description: 'Use OIDC instead of token. This will ignore any token supplied'
     required: false
   verbose:
     description: 'Specify whether the Codecov output should be verbose'
     required: false
   version:
-    description: 'Specify which version of the Codecov Uploader should be used. Defaults to `latest`'
+    description: 'Specify which version of the Codecov CLI should be used. Defaults to `latest`'
     required: false
   working-directory:
     description: 'Directory in which to execute codecov.sh'
     required: false
-  xcode:
-    description: 'Run with xcode support'
-    required: false
-  xcode_archive_path:
-    description: 'Specify the xcode archive path. Likely specified as the -resultBundlePath and should end in .xcresult'
-    required: false
-  xtra_args:
-    description: 'Add additional uploader args that may be missing in the Action'
-    required: false
 branding:
   color: 'red'
   icon: 'umbrella'
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'dist/index.js'

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecov-action",
-  "version": "3.1.6",
+  "version": "4.6.0",
   "description": "Upload coverage reports to Codecov from GitHub Actions",
   "main": "index.js",
   "scripts": {
@@ -23,23 +23,22 @@
   },
   "homepage": "https://github.com/codecov/codecov-action#readme",
   "dependencies": {
-    "@actions/core": "^1.10.0",
+    "@actions/core": "^1.10.1",
     "@actions/exec": "^1.1.1",
-    "@actions/github": "^5.1.1",
+    "@actions/github": "^6.0.0",
-    "node-fetch": "^3.3.1",
+    "undici": "5.28.4"
-    "openpgp": "5.8"
   },
   "devDependencies": {
-    "@types/jest": "^27.5.0",
+    "@octokit/webhooks-types": "^7.5.1",
-    "@types/node": "^20.1.4",
+    "@types/jest": "^29.5.13",
-    "@typescript-eslint/eslint-plugin": "^4.29.2",
+    "@typescript-eslint/eslint-plugin": "^8.8.0",
-    "@typescript-eslint/parser": "^4.29.2",
+    "@typescript-eslint/parser": "^8.8.0",
-    "@vercel/ncc": "^0.36.1",
+    "@vercel/ncc": "^0.38.2",
-    "eslint": "^7.32.0",
+    "eslint": "^8.57.1",
     "eslint-config-google": "^0.14.0",
-    "jest": "^26.6.3",
+    "jest": "^29.7.0",
     "jest-junit": "^16.0.0",
-    "ts-jest": "^26.5.6",
+    "ts-jest": "^29.2.5",
-    "typescript": "^4.9.5"
+    "typescript": "^5.6.2"
   }
 }

src/buildExec.test.ts

@@ -1,85 +1,120 @@
 import * as github from '@actions/github';
 
-import buildExec from './buildExec';
+import {
-
+  buildCommitExec,
-/* eslint-disable  @typescript-eslint/no-var-requires */
+  buildGeneralExec,
-const {version} = require('../package.json');
+  buildReportExec,
+  buildUploadExec,
+  getToken,
+} from './buildExec';
 
 const context = github.context;
 
-test('no arguments', () => {
+let OLDOS = process.env.RUNNER_OS;
-  const {execArgs, failCi} = buildExec();
 
-  const args = [
+beforeEach(() => {
-    '-n',
+  jest.resetModules();
-    '',
+  OLDOS = process.env.RUNNER_OS;
-    '-Q',
-    `github-action-${version}`,
-  ];
-  if (context.eventName == 'pull_request') {
-    args.push('-C', `${context.payload.pull_request.head.sha}`);
-  }
-  expect(execArgs).toEqual(args);
-  expect(failCi).toBeFalsy();
 });
 
-test('all arguments', () => {
+afterAll(() => {
-  const envs = {
+  process.env.RUNNER_OS = OLDOS;
-    'commit_parent': '83231650328f11695dfb754ca0f540516f188d27',
+});
-    'directory': 'coverage/',
-    'dry_run': 'true',
-    'env_vars': 'OS,PYTHON',
-    'fail_ci_if_error': 'true',
-    'file': 'coverage.xml',
-    'files': 'dir1/coverage.xml,dir2/coverage.xml',
-    'flags': 'test,test2',
-    'functionalities': 'network',
-    'full_report': 'oldDir/oldReport.json',
-    'gcov': 'true',
-    'gcov_args': '-v',
-    'gcov_ignore': '*.fake',
-    'gcov_include': 'real_file',
-    'gcov_executable': 'gcov2',
-    'move_coverage_to_trash': 'true',
-    'name': 'codecov',
-    'network_filter': 'src/',
-    'network_prefix': 'build/',
-    'override_branch': 'thomasrockhu/test',
-    'override_build': '1',
-    'override_commit': '9caabca5474b49de74ef5667deabaf74cdacc244',
-    'override_pr': '2',
-    'override_tag': 'v1.2',
-    'root_dir': 'root/',
-    'swift': 'true',
-    'swift_project': 'MyApp',
-    'slug': 'fakeOwner/fakeRepo',
-    'token': 'd3859757-ab80-4664-924d-aef22fa7557b',
-    'upstream_proxy': 'https://codecov.example.com',
-    'url': 'https://codecov.enterprise.com',
-    'verbose': 't',
-    'xcode': 'true',
-    'xcode_archive_path': '/test.xcresult',
-    'xtra_args': '--some --other --args',
-  };
 
+test('general args', async () => {
+  const envs = {
+    codecov_yml_path: 'dev/codecov.yml',
+    url: 'https://codecov.enterprise.com',
+    verbose: 't',
+  };
   for (const env of Object.keys(envs)) {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {execArgs, failCi} = buildExec();
+  const {args, verbose} = await buildGeneralExec();
-  expect(execArgs).toEqual([
+
-    '-n',
+  expect(args).toEqual(
-    'codecov',
+      expect.arrayContaining([
-    '-Q',
+        '--codecov-yml-path',
-    `github-action-${version}`,
+        'dev/codecov.yml',
-    '-c',
+        '--enterprise-url',
-    '-N',
+        'https://codecov.enterprise.com',
-    '83231650328f11695dfb754ca0f540516f188d27',
+        '-v',
+      ]));
+  expect(verbose).toBeTruthy();
+  for (const env of Object.keys(envs)) {
+    delete process.env['INPUT_' + env.toUpperCase()];
+  }
+});
+
+test('upload args using context', async () => {
+  const expectedArgs = [
+    '--git-service',
+    'github',
+  ];
+  const {uploadExecArgs, uploadCommand} = await buildUploadExec();
+  if (context.eventName == 'pull_request') {
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
+  }
+  if (context.eventName == 'pull_request_target') {
+    expectedArgs.push('-P', `${context.payload.number}`);
+  }
+
+  expect(uploadExecArgs).toEqual(expectedArgs);
+  expect(uploadCommand).toEqual('do-upload');
+});
+
+test('upload args', async () => {
+  const envs = {
+    'codecov_yml_path': 'dev/codecov.yml',
+    'commit_parent': 'fakeparentcommit',
+    'directory': 'coverage/',
+    'disable_file_fixes': 'true',
+    'disable_search': 'true',
+    'dry_run': 'true',
+    'env_vars': 'OS,PYTHON',
+    'exclude': 'node_modules/',
+    'fail_ci_if_error': 'true',
+    'file': 'coverage.xml',
+    'files': 'dir1/coverage.xml,dir2/coverage.xml,',
+    'flags': 'test,test2',
+    'git_service': 'github_enterprise',
+    'handle_no_reports_found': 'true',
+    'job_code': '32',
+    'name': 'codecov',
+    'os': 'macos',
+    'override_branch': 'thomasrockhu/test',
+    'override_build': '1',
+    'override_build_url': 'https://example.com/build/2',
+    'override_commit': '9caabca5474b49de74ef5667deabaf74cdacc244',
+    'override_pr': '2',
+    'network_filter': 'subA/',
+    'network_prefix': 'forA/',
+    'plugin': 'xcode',
+    'plugins': 'pycoverage,compress-pycoverage',
+    'report_code': 'testCode',
+    'root_dir': 'root/',
+    'slug': 'fakeOwner/fakeRepo',
+    'token': 'd3859757-ab80-4664-924d-aef22fa7557b',
+    'url': 'https://enterprise.example.com',
+    'use_legacy_upload_endpoint': 'true',
+    'verbose': 'true',
+    'version': '0.1.2',
+    'working-directory': 'src',
+  };
+  for (const env of Object.keys(envs)) {
+    process.env['INPUT_' + env.toUpperCase()] = envs[env];
+  }
+
+  const {uploadExecArgs, uploadCommand} = await buildUploadExec();
+  const expectedArgs = [
+    '--disable-file-fixes',
+    '--disable-search',
     '-d',
     '-e',
     'OS,PYTHON',
-    '-X',
+    '--exclude',
-    'network',
+    'node_modules/',
     '-Z',
     '-f',
     'coverage.xml',
@@ -87,138 +122,247 @@ test('all arguments', () => {
     'dir1/coverage.xml',
     '-f',
     'dir2/coverage.xml',
-    '--full',
-    'oldDir/oldReport.json',
     '-F',
     'test',
     '-F',
     'test2',
-    '-g',
+    '--git-service',
-    '--ga',
+    'github_enterprise',
-    '-v',
+    '--handle-no-reports-found',
-    '--gi',
+    '--job-code',
-    '*.fake',
+    '32',
-    '--gI',
+    '-n',
-    'real_file',
+    'codecov',
-    '--gx',
+    '--network-filter',
-    'gcov2',
+    'subA/',
-    '-i',
+    '--network-prefix',
-    'src/',
+    'forA/',
-    '-k',
-    'build/',
     '-B',
     'thomasrockhu/test',
     '-b',
     '1',
+    '--build-url',
+    'https://example.com/build/2',
     '-C',
     '9caabca5474b49de74ef5667deabaf74cdacc244',
     '-P',
     '2',
-    '-T',
+    '--plugin',
-    'v1.2',
+    'xcode',
-    '-R',
+    '--plugin',
+    'pycoverage',
+    '--plugin',
+    'compress-pycoverage',
+    '--report-code',
+    'testCode',
+    '--network-root-folder',
     'root/',
     '-s',
     'coverage/',
     '-r',
     'fakeOwner/fakeRepo',
-    '--xs',
+    '--legacy',
-    '--xsp',
+  ];
-    'MyApp',
-    '-U',
-    'https://codecov.example.com',
-    '-u',
-    'https://codecov.enterprise.com',
-    '-v',
-    '--xc',
-    '--xp',
-    '/test.xcresult',
-    '--some --other --args',
-  ]);
-  expect(failCi).toBeTruthy();
 
+  expect(uploadExecArgs).toEqual(expectedArgs);
+  expect(uploadCommand).toEqual('do-upload');
   for (const env of Object.keys(envs)) {
     delete process.env['INPUT_' + env.toUpperCase()];
   }
 });
 
-describe('trim arguments after splitting them', () => {
+
-  const baseExpectation = [
+test('report args', async () => {
-    '-n',
+  const envs = {
-    expect.stringContaining(''),
+    git_service: 'github_enterprise',
-    '-Q',
+    override_commit: '9caabca5474b49de74ef5667deabaf74cdacc244',
-    expect.stringContaining('github-action'),
+    override_pr: 'fakePR',
+    slug: 'fakeOwner/fakeRepo',
+    token: 'd3859757-ab80-4664-924d-aef22fa7557b',
+    fail_ci_if_error: 'true',
+  };
+  for (const env of Object.keys(envs)) {
+    process.env['INPUT_' + env.toUpperCase()] = envs[env];
+  }
+
+  const {reportExecArgs, reportCommand} = await buildReportExec();
+
+  const expectedArgs = [
+    '--git-service',
+    'github_enterprise',
+    '-C',
+    '9caabca5474b49de74ef5667deabaf74cdacc244',
+    '-P',
+    'fakePR',
+    '--slug',
+    'fakeOwner/fakeRepo',
+    '-Z',
   ];
 
-  test('files', () => {
+  expect(reportExecArgs).toEqual(expectedArgs);
-    const envs = {'files': './client-coverage.txt, ./lcov.info'};
+  expect(reportCommand).toEqual('create-report');
-
+  for (const env of Object.keys(envs)) {
-    for (const [name, value] of Object.entries(envs)) {
+    delete process.env['INPUT_' + env.toUpperCase()];
-      process.env['INPUT_' + name.toUpperCase()] = value;
+  }
-    }
+});
-
+
-    const {execArgs} = buildExec();
+
-
+test('report args using context', async () => {
-    expect(execArgs).toEqual(
+  const envs = {
-        expect.arrayContaining([
+    token: 'd3859757-ab80-4664-924d-aef22fa7557b',
-          ...baseExpectation,
+  };
-          '-f',
+  for (const env of Object.keys(envs)) {
-          './client-coverage.txt',
+    process.env['INPUT_' + env.toUpperCase()] = envs[env];
-          '-f',
+  }
-          './lcov.info',
+  const expectedArgs: string[] = [
-        ]),
+    '--git-service',
-    );
+    'github',
-
+  ];
-    for (const env of Object.keys(envs)) {
+  if (context.eventName == 'pull_request') {
-      delete process.env['INPUT_' + env.toUpperCase()];
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
-    }
+  }
-  });
+
-
+  const {reportExecArgs, reportCommand} = await buildReportExec();
-  test('flags', () => {
+
-    const envs = {'flags': 'ios, mobile'};
+  expect(reportExecArgs).toEqual(expectedArgs);
-
+  expect(reportCommand).toEqual('create-report');
-    for (const [name, value] of Object.entries(envs)) {
+  for (const env of Object.keys(envs)) {
-      process.env['INPUT_' + name.toUpperCase()] = value;
+    delete process.env['INPUT_' + env.toUpperCase()];
-    }
+  }
-
+});
-    const {execArgs} = buildExec();
+
-
+
-    expect(execArgs).toEqual(
+test('commit args', async () => {
-        expect.arrayContaining([
+  const envs = {
-          ...baseExpectation,
+    git_service: 'github_enterprise',
-          '-F',
+    commit_parent: '83231650328f11695dfb754ca0f540516f188d27',
-          'ios',
+    override_branch: 'thomasrockhu/test',
-          '-F',
+    override_commit: '9caabca5474b49de74ef5667deabaf74cdacc244',
-          'mobile',
+    override_pr: '2',
-        ]),
+    slug: 'fakeOwner/fakeRepo',
-    );
+    token: 'd3859757-ab80-4664-924d-aef22fa7557b',
-
+    fail_ci_if_error: 'true',
-    for (const env of Object.keys(envs)) {
+  };
-      delete process.env['INPUT_' + env.toUpperCase()];
+  for (const env of Object.keys(envs)) {
-    }
+    process.env['INPUT_' + env.toUpperCase()] = envs[env];
-  });
+  }
-
+
-  test('functionalities', () => {
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
-    const envs = {'functionalities': 'network, gcov'};
+  const expectedArgs = [
-
+    '--parent-sha',
-    for (const [name, value] of Object.entries(envs)) {
+    '83231650328f11695dfb754ca0f540516f188d27',
-      process.env['INPUT_' + name.toUpperCase()] = value;
+    '--git-service',
-    }
+    'github_enterprise',
-
+    '-B',
-    const {execArgs} = buildExec();
+    'thomasrockhu/test',
-
+    '-C',
-    expect(execArgs).toEqual(
+    '9caabca5474b49de74ef5667deabaf74cdacc244',
-        expect.arrayContaining([
+    '--pr',
-          ...baseExpectation,
+    '2',
-          '-X',
+    '--slug',
-          'network',
+    'fakeOwner/fakeRepo',
-          '-X',
+    '-Z',
-          'gcov',
+  ];
-        ]),
+
-    );
+  expect(commitExecArgs).toEqual(expectedArgs);
-
+  expect(commitCommand).toEqual('create-commit');
-    for (const env of Object.keys(envs)) {
+  for (const env of Object.keys(envs)) {
-      delete process.env['INPUT_' + env.toUpperCase()];
+    delete process.env['INPUT_' + env.toUpperCase()];
-    }
+  }
-  });
+});
+
+test('commit args using context', async () => {
+  const expectedArgs: string[] = [
+    '--git-service',
+    'github',
+  ];
+
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
+  if (
+    (context.eventName == 'pull_request' || context.eventName == 'pull_request_target') &&
+    context.payload.pull_request?.base.label.split(':')[0] != context.payload.pull_request?.head.label.split(':')[0]
+  ) {
+    expectedArgs.push('-B', `${context.payload.pull_request?.head.label}`);
+  }
+  if (context.eventName == 'pull_request') {
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
+  }
+  if (context.eventName == 'pull_request_target') {
+    expectedArgs.push('-P', `${context.payload.number}`);
+  }
+
+  expect(commitExecArgs).toEqual(expectedArgs);
+  expect(commitCommand).toEqual('create-commit');
+});
+
+test('commit args using github server url', async () => {
+  const expectedArgs: string[] = [
+    '--git-service',
+    'github_enterprise',
+  ];
+
+  process.env.GITHUB_SERVER_URL = 'https://example.com';
+
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
+  if (
+    (context.eventName == 'pull_request' || context.eventName == 'pull_request_target') &&
+    context.payload.pull_request?.base.label.split(':')[0] != context.payload.pull_request?.head.label.split(':')[0]
+  ) {
+    expectedArgs.push('-B', `${context.payload.pull_request?.head.label}`);
+  }
+  if (context.eventName == 'pull_request') {
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
+  }
+  if (context.eventName == 'pull_request_target') {
+    expectedArgs.push('-P', `${context.payload.number}`);
+  }
+  expect(commitExecArgs).toEqual(expectedArgs);
+  expect(commitCommand).toEqual('create-commit');
+});
+
+test('build commit args when token arg is unset and from fork', async () => {
+  context.eventName = 'pull_request';
+  context.payload.pull_request = {
+    'number': 1,
+    'base': {
+      'label': 'hello:main',
+    },
+    'head': {
+      'label': 'world:feat',
+      'sha': 'aaaaaa',
+    },
+  };
+
+  const expectedArgs: string[] = [
+    '--git-service',
+    'github_enterprise',
+    '-B',
+    'world:feat',
+    '-C',
+    `${context.payload.pull_request?.head.sha}`,
+  ];
+
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
+
+  expect(commitExecArgs).toEqual(expectedArgs);
+  expect(commitCommand).toEqual('create-commit');
+});
+
+test('get token when token arg is unset and from fork', async () => {
+  context.eventName = 'pull_request';
+  context.payload.pull_request = {
+    'number': 1,
+    'base': {
+      'label': 'hello:main',
+    },
+    'head': {
+      'label': 'world:feat',
+      'sha': 'aaaaaa',
+    },
+  };
+
+
+  const token = await getToken();
+
+  expect(token).toEqual('');
 });

src/buildExec.ts

@@ -1,11 +1,14 @@
+/* eslint-disable  @typescript-eslint/no-explicit-any */
+
 import * as core from '@actions/core';
 import * as github from '@actions/github';
+import {type PullRequestEvent} from '@octokit/webhooks-types';
 
-import {version} from '../package.json';
+import {setFailure} from './helpers';
 
 const context = github.context;
 
-const isTrue = (variable) => {
+const isTrue = (variable: string): boolean => {
   const lowercase = variable.toLowerCase();
   return (
     lowercase === '1' ||
@@ -16,56 +19,255 @@ const isTrue = (variable) => {
   );
 };
 
-const buildExec = () => {
+const getGitService = (): string => {
-  const clean = core.getInput('move_coverage_to_trash');
+  const overrideGitService = core.getInput('git_service');
+  const serverUrl = process.env.GITHUB_SERVER_URL;
+  if (overrideGitService) {
+    return overrideGitService;
+  } else if (serverUrl !== undefined && serverUrl !== 'https://github.com') {
+    return 'github_enterprise';
+  }
+  return 'github';
+};
+
+const isPullRequestFromFork = (): boolean => {
+  core.info(`eventName: ${context.eventName}`);
+  if (!['pull_request', 'pull_request_target'].includes(context.eventName)) {
+    return false;
+  }
+
+  const baseLabel = context.payload.pull_request.base.label;
+  const headLabel = context.payload.pull_request.head.label;
+
+  core.info(`baseRef: ${baseLabel} | headRef: ${headLabel}`);
+  return baseLabel.split(':')[0] !== headLabel.split(':')[0];
+};
+
+const getToken = async (): Promise<string> => {
+  let token = core.getInput('token');
+  let url = core.getInput('url');
+  const useOIDC = isTrue(core.getInput('use_oidc'));
+  if (useOIDC) {
+    if (!url) {
+      url = 'https://codecov.io';
+    }
+    try {
+      token = await core.getIDToken(url);
+      return Promise.resolve(token);
+    } catch (err) {
+      setFailure(
+          `Codecov: Failed to get OIDC token with url: ${url}. ${err.message}`,
+          true,
+      );
+    }
+  }
+  return token;
+};
+
+const getOverrideBranch = (token: string): string => {
+  let overrideBranch = core.getInput('override_branch');
+  if (!overrideBranch && !token && isPullRequestFromFork()) {
+    core.info('==> Fork detected, tokenless uploading used');
+    // backwards compatibility with certain versions of the CLI that expect this
+    process.env['TOKENLESS'] = context.payload.pull_request.head.label;
+    overrideBranch =context.payload.pull_request.head.label;
+  }
+  return overrideBranch;
+};
+
+const buildCommitExec = async (): Promise<{
+  commitExecArgs: any[];
+  commitOptions: any;
+  commitCommand: string;
+}> => {
   const commitParent = core.getInput('commit_parent');
+  const gitService = getGitService();
+  const overrideCommit = core.getInput('override_commit');
+  const overridePr = core.getInput('override_pr');
+  const slug = core.getInput('slug');
+  const token = await getToken();
+  const overrideBranch = getOverrideBranch(token);
+  const failCi = isTrue(core.getInput('fail_ci_if_error'));
+  const workingDir = core.getInput('working-directory');
+
+  const commitCommand = 'create-commit';
+  const commitExecArgs: string[] = [];
+
+  const commitOptions: any = {};
+  commitOptions.env = Object.assign(process.env, {
+    GITHUB_ACTION: process.env.GITHUB_ACTION,
+    GITHUB_RUN_ID: process.env.GITHUB_RUN_ID,
+    GITHUB_REF: process.env.GITHUB_REF,
+    GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY,
+    GITHUB_SHA: process.env.GITHUB_SHA,
+    GITHUB_HEAD_REF: process.env.GITHUB_HEAD_REF || '',
+  });
+
+  if (token) {
+    commitOptions.env.CODECOV_TOKEN = token;
+  }
+  if (commitParent) {
+    commitExecArgs.push('--parent-sha', commitParent);
+  }
+  commitExecArgs.push('--git-service', gitService);
+
+  if (overrideBranch) {
+    commitExecArgs.push('-B', overrideBranch);
+  }
+  if (overrideCommit) {
+    commitExecArgs.push('-C', overrideCommit);
+  } else if (
+    ['pull_request', 'pull_request_target'].includes(context.eventName)
+  ) {
+    const payload = context.payload as PullRequestEvent;
+    commitExecArgs.push('-C', payload.pull_request.head.sha);
+  }
+  if (overridePr) {
+    commitExecArgs.push('--pr', overridePr);
+  } else if (context.eventName === 'pull_request_target') {
+    const payload = context.payload as PullRequestEvent;
+    commitExecArgs.push('--pr', payload.number.toString());
+  }
+  if (slug) {
+    commitExecArgs.push('--slug', slug);
+  }
+  if (failCi) {
+    commitExecArgs.push('-Z');
+  }
+  if (workingDir) {
+    commitOptions.cwd = workingDir;
+  }
+
+  return {commitExecArgs, commitOptions, commitCommand};
+};
+
+const buildGeneralExec = (): {
+  args: any[];
+  verbose: boolean;
+} => {
+  const codecovYmlPath = core.getInput('codecov_yml_path');
+  const url = core.getInput('url');
+  const verbose = isTrue(core.getInput('verbose'));
+  const args = [];
+
+  if (codecovYmlPath) {
+    args.push('--codecov-yml-path', codecovYmlPath);
+  }
+  if (url) {
+    args.push('--enterprise-url', url);
+  }
+  if (verbose) {
+    args.push('-v');
+  }
+  return {args, verbose};
+};
+
+const buildReportExec = async (): Promise<{
+  reportExecArgs: any[];
+  reportOptions: any;
+  reportCommand: string;
+}> => {
+  const gitService = getGitService();
+  const overrideCommit = core.getInput('override_commit');
+  const overridePr = core.getInput('override_pr');
+  const slug = core.getInput('slug');
+  const token = await getToken();
+  const failCi = isTrue(core.getInput('fail_ci_if_error'));
+  const workingDir = core.getInput('working-directory');
+
+  const reportCommand = 'create-report';
+  const reportExecArgs: string[] = [];
+
+  const reportOptions: any = {};
+  reportOptions.env = Object.assign(process.env, {
+    GITHUB_ACTION: process.env.GITHUB_ACTION,
+    GITHUB_RUN_ID: process.env.GITHUB_RUN_ID,
+    GITHUB_REF: process.env.GITHUB_REF,
+    GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY,
+    GITHUB_SHA: process.env.GITHUB_SHA,
+    GITHUB_HEAD_REF: process.env.GITHUB_HEAD_REF || '',
+  });
+
+  if (token) {
+    reportOptions.env.CODECOV_TOKEN = token;
+  }
+  reportExecArgs.push('--git-service', gitService);
+
+  if (overrideCommit) {
+    reportExecArgs.push('-C', overrideCommit);
+  } else if (
+    ['pull_request', 'pull_request_target'].includes(context.eventName)
+  ) {
+    const payload = context.payload as PullRequestEvent;
+    reportExecArgs.push('-C', payload.pull_request.head.sha);
+  }
+  if (overridePr) {
+    reportExecArgs.push('-P', overridePr);
+  } else if (context.eventName == 'pull_request_target') {
+    const payload = context.payload as PullRequestEvent;
+    reportExecArgs.push('-P', payload.number.toString());
+  }
+  if (slug) {
+    reportExecArgs.push('--slug', slug);
+  }
+  if (failCi) {
+    reportExecArgs.push('-Z');
+  }
+  if (workingDir) {
+    reportOptions.cwd = workingDir;
+  }
+
+  return {reportExecArgs, reportOptions, reportCommand};
+};
+
+const buildUploadExec = async (): Promise<{
+  uploadExecArgs: any[];
+  uploadOptions: any;
+  disableSafeDirectory: boolean;
+  failCi: boolean;
+  os: string;
+  uploaderVersion: string;
+  uploadCommand: string;
+}> => {
+  const disableFileFixes = isTrue(core.getInput('disable_file_fixes'));
+  const disableSafeDirectory = isTrue(core.getInput('disable_safe_directory'));
+  const disableSearch = isTrue(core.getInput('disable_search'));
   const dryRun = isTrue(core.getInput('dry_run'));
   const envVars = core.getInput('env_vars');
+  const exclude = core.getInput('exclude');
   const failCi = isTrue(core.getInput('fail_ci_if_error'));
   const file = core.getInput('file');
   const files = core.getInput('files');
   const flags = core.getInput('flags');
-  const fullReport = core.getInput('full_report');
+  const gitService = getGitService();
-  const functionalities = core.getInput('functionalities');
+  const handleNoReportsFound = isTrue(core.getInput('handle_no_reports_found'));
-  const gcov = core.getInput('gcov');
+  const jobCode = core.getInput('job_code');
-  const gcovArgs = core.getInput('gcov_args');
-  const gcovExecutable = core.getInput('gcov_executable');
-  const gcovIgnore = core.getInput('gcov_ignore');
-  const gcovInclude = core.getInput('gcov_include');
   const name = core.getInput('name');
   const networkFilter = core.getInput('network_filter');
   const networkPrefix = core.getInput('network_prefix');
   const os = core.getInput('os');
   const overrideBranch = core.getInput('override_branch');
   const overrideBuild = core.getInput('override_build');
+  const overrideBuildUrl = core.getInput('override_build_url');
   const overrideCommit = core.getInput('override_commit');
   const overridePr = core.getInput('override_pr');
-  const overrideTag = core.getInput('override_tag');
+  const plugin = core.getInput('plugin');
+  const plugins = core.getInput('plugins');
+  const reportCode = core.getInput('report_code');
   const rootDir = core.getInput('root_dir');
   const searchDir = core.getInput('directory');
   const slug = core.getInput('slug');
-  const swift = core.getInput('swift');
+  const token = await getToken();
-  const swiftProject = core.getInput('swift_project');
-  const token = core.getInput('token');
-  const upstream = core.getInput('upstream_proxy');
-  const url = core.getInput('url');
-  const verbose = isTrue(core.getInput('verbose'));
-  const workingDir = core.getInput('working-directory');
-  const xcode = core.getInput('xcode');
-  const xcodeArchivePath = core.getInput('xcode_archive_path');
-  const xtraArgs = core.getInput('xtra_args');
   let uploaderVersion = core.getInput('version');
-
+  const useLegacyUploadEndpoint = isTrue(
-  const execArgs = [];
+      core.getInput('use_legacy_upload_endpoint'),
-  execArgs.push(
-      '-n',
-      `${name}`,
-      '-Q',
-      `github-action-${version}`,
   );
+  const workingDir = core.getInput('working-directory');
 
-  const options:any = {};
+  const uploadExecArgs: string[] = [];
-  options.env = Object.assign(process.env, {
+  const uploadCommand = 'do-upload';
+  const uploadOptions: any = {};
+  uploadOptions.env = Object.assign(process.env, {
     GITHUB_ACTION: process.env.GITHUB_ACTION,
     GITHUB_RUN_ID: process.env.GITHUB_RUN_ID,
     GITHUB_REF: process.env.GITHUB_REF,
@@ -78,144 +280,141 @@ const buildExec = () => {
   for (const envVar of envVars.split(',')) {
     const envVarClean = envVar.trim();
     if (envVarClean) {
-      options.env[envVarClean] = process.env[envVarClean];
+      uploadOptions.env[envVarClean] = process.env[envVarClean];
       envVarsArg.push(envVarClean);
     }
   }
-
   if (token) {
-    options.env.CODECOV_TOKEN = token;
+    uploadOptions.env.CODECOV_TOKEN = token;
   }
-  if (clean) {
+  if (disableFileFixes) {
-    execArgs.push('-c');
+    uploadExecArgs.push('--disable-file-fixes');
   }
-  if (commitParent) {
+  if (disableSearch) {
-    execArgs.push('-N', `${commitParent}`);
+    uploadExecArgs.push('--disable-search');
   }
   if (dryRun) {
-    execArgs.push('-d');
+    uploadExecArgs.push('-d');
   }
   if (envVarsArg.length) {
-    execArgs.push('-e', envVarsArg.join(','));
+    uploadExecArgs.push('-e', envVarsArg.join(','));
   }
-  if (functionalities) {
+  if (exclude) {
-    functionalities.split(',').map((f) => f.trim()).forEach((f) => {
+    uploadExecArgs.push('--exclude', exclude);
-      execArgs.push('-X', `${f}`);
-    });
   }
   if (failCi) {
-    execArgs.push('-Z');
+    uploadExecArgs.push('-Z');
   }
   if (file) {
-    execArgs.push('-f', `${file}`);
+    uploadExecArgs.push('-f', file);
   }
   if (files) {
-    files.split(',').map((f) => f.trim()).forEach((f) => {
+    files
-      execArgs.push('-f', `${f}`);
+        .split(',')
-    });
+        .map((f) => f.trim())
-  }
+        .forEach((f) => {
-  if (fullReport) {
+          if (f.length > 0) {
-    execArgs.push('--full', `${fullReport}`);
+          // this handles trailing commas
+            uploadExecArgs.push('-f', f);
+          }
+        });
   }
   if (flags) {
-    flags.split(',').map((f) => f.trim()).forEach((f) => {
+    flags
-      execArgs.push('-F', `${f}`);
+        .split(',')
-    });
+        .map((f) => f.trim())
+        .forEach((f) => {
+          uploadExecArgs.push('-F', f);
+        });
   }
-
+  uploadExecArgs.push('--git-service', gitService);
-  if (gcov) {
+  if (handleNoReportsFound) {
-    execArgs.push('-g');
+    uploadExecArgs.push('--handle-no-reports-found');
   }
-  if (gcovArgs) {
+  if (jobCode) {
-    execArgs.push('--ga', `${gcovArgs}`);
+    uploadExecArgs.push('--job-code', jobCode);
   }
-  if (gcovIgnore) {
+  if (name) {
-    execArgs.push('--gi', `${gcovIgnore}`);
+    uploadExecArgs.push('-n', name);
   }
-  if (gcovInclude) {
-    execArgs.push('--gI', `${gcovInclude}`);
-  }
-  if (gcovExecutable) {
-    execArgs.push('--gx', `${gcovExecutable}`);
-  }
-
   if (networkFilter) {
-    execArgs.push('-i', `${networkFilter}`);
+    uploadExecArgs.push('--network-filter', networkFilter);
   }
   if (networkPrefix) {
-    execArgs.push('-k', `${networkPrefix}`);
+    uploadExecArgs.push('--network-prefix', networkPrefix);
   }
-
   if (overrideBranch) {
-    execArgs.push('-B', `${overrideBranch}`);
+    uploadExecArgs.push('-B', overrideBranch);
   }
   if (overrideBuild) {
-    execArgs.push('-b', `${overrideBuild}`);
+    uploadExecArgs.push('-b', overrideBuild);
+  }
+  if (overrideBuildUrl) {
+    uploadExecArgs.push('--build-url', overrideBuildUrl);
   }
   if (overrideCommit) {
-    execArgs.push('-C', `${overrideCommit}`);
+    uploadExecArgs.push('-C', overrideCommit);
   } else if (
-    `${context.eventName}` == 'pull_request' ||
+    ['pull_request', 'pull_request_target'].includes(context.eventName)
-    `${context.eventName}` == 'pull_request_target'
   ) {
-    execArgs.push('-C', `${context.payload.pull_request.head.sha}`);
+    const payload = context.payload as PullRequestEvent;
+    uploadExecArgs.push('-C', payload.pull_request.head.sha);
   }
   if (overridePr) {
-    execArgs.push('-P', `${overridePr}`);
+    uploadExecArgs.push('-P', overridePr);
-  } else if (
+  } else if (context.eventName == 'pull_request_target') {
-    `${context.eventName}` == 'pull_request_target'
+    const payload = context.payload as PullRequestEvent;
-  ) {
+    uploadExecArgs.push('-P', payload.number.toString());
-    execArgs.push('-P', `${context.payload.number}`);
   }
-  if (overrideTag) {
+  if (plugin) {
-    execArgs.push('-T', `${overrideTag}`);
+    uploadExecArgs.push('--plugin', plugin);
+  }
+  if (plugins) {
+    plugins
+        .split(',')
+        .map((p) => p.trim())
+        .forEach((p) => {
+          uploadExecArgs.push('--plugin', p);
+        });
+  }
+  if (reportCode) {
+    uploadExecArgs.push('--report-code', reportCode);
   }
   if (rootDir) {
-    execArgs.push('-R', `${rootDir}`);
+    uploadExecArgs.push('--network-root-folder', rootDir);
   }
   if (searchDir) {
-    execArgs.push('-s', `${searchDir}`);
+    uploadExecArgs.push('-s', searchDir);
   }
   if (slug) {
-    execArgs.push('-r', `${slug}`);
+    uploadExecArgs.push('-r', slug);
   }
-  if (swift) {
+  if (workingDir) {
-    execArgs.push('--xs');
+    uploadOptions.cwd = workingDir;
   }
-  if (swift && swiftProject) {
-    execArgs.push('--xsp', `${swiftProject}`);
-  }
-  if (upstream) {
-    execArgs.push('-U', `${upstream}`);
-  }
-  if (url) {
-    execArgs.push('-u', `${url}`);
-  }
-  if (verbose) {
-    execArgs.push('-v');
-  }
-  if (xcode && xcodeArchivePath) {
-    execArgs.push('--xc');
-    execArgs.push('--xp', `${xcodeArchivePath}`);
-  }
-
   if (uploaderVersion == '') {
     uploaderVersion = 'latest';
   }
-
+  if (useLegacyUploadEndpoint) {
-  if (verbose) {
+    uploadExecArgs.push('--legacy');
-    console.debug({execArgs});
   }
 
-  if (workingDir) {
+  return {
-    options.cwd = workingDir;
+    uploadExecArgs,
-  }
+    uploadOptions,
-
+    disableSafeDirectory,
-  if (xtraArgs) {
+    failCi,
-    execArgs.push(`${xtraArgs}`);
+    os,
-  }
+    uploaderVersion,
-
+    uploadCommand,
-  return {execArgs, options, failCi, os, uploaderVersion, verbose};
+  };
 };
 
-export default buildExec;
+
+export {
+  buildCommitExec,
+  buildGeneralExec,
+  buildReportExec,
+  buildUploadExec,
+  getToken,
+};

src/helpers.test.ts

@@ -1,9 +1,13 @@
+import * as exec from '@actions/exec';
+
 import {
+  PLATFORMS,
   getBaseUrl,
+  getCommand,
   getPlatform,
   isValidPlatform,
   isWindows,
-  PLATFORMS,
+  setSafeDirectory,
 } from './helpers';
 
 let OLDOS = process.env.RUNNER_OS;
@@ -39,34 +43,54 @@ test('getBaseUrl', () => {
   expect(PLATFORMS.map((platform) => {
     return getBaseUrl(platform, 'latest');
   })).toEqual([
-    'https://uploader.codecov.io/latest/aarch64/codecov',
+    'https://cli.codecov.io/latest/linux/codecov',
-    'https://uploader.codecov.io/latest/alpine/codecov',
+    'https://cli.codecov.io/latest/macos/codecov',
-    'https://uploader.codecov.io/latest/linux/codecov',
+    'https://cli.codecov.io/latest/windows/codecov.exe',
-    'https://uploader.codecov.io/latest/macos/codecov',
+    'https://cli.codecov.io/latest/alpine/codecov',
-    'https://uploader.codecov.io/latest/windows/codecov.exe',
+    'https://cli.codecov.io/latest/linux-arm64/codecov',
+    'https://cli.codecov.io/latest/alpine-arm64/codecov',
   ]);
 
   expect(PLATFORMS.map((platform) => {
     return getBaseUrl(platform, 'v0.1.0_8880');
   })).toEqual([
-    'https://uploader.codecov.io/v0.1.0_8880/aarch64/codecov',
+    'https://cli.codecov.io/v0.1.0_8880/linux/codecov',
-    'https://uploader.codecov.io/v0.1.0_8880/alpine/codecov',
+    'https://cli.codecov.io/v0.1.0_8880/macos/codecov',
-    'https://uploader.codecov.io/v0.1.0_8880/linux/codecov',
+    'https://cli.codecov.io/v0.1.0_8880/windows/codecov.exe',
-    'https://uploader.codecov.io/v0.1.0_8880/macos/codecov',
+    'https://cli.codecov.io/v0.1.0_8880/alpine/codecov',
-    'https://uploader.codecov.io/v0.1.0_8880/windows/codecov.exe',
+    'https://cli.codecov.io/v0.1.0_8880/linux-arm64/codecov',
+    'https://cli.codecov.io/v0.1.0_8880/alpine-arm64/codecov',
   ]);
 });
 
 test('isWindows', () => {
   expect(PLATFORMS.map((platform) => {
     return isWindows(platform);
-  })).toEqual([false, false, false, false, true]);
+  })).toEqual([false, false, true, false, false, false]);
 });
 
 test('isValidPlatform', () => {
   expect(PLATFORMS.map((platform) => {
     return isValidPlatform(platform);
-  })).toEqual([true, true, true, true, true]);
+  })).toEqual([true, true, true, true, true, true]);
 
   expect(isValidPlatform('fakeos')).toBeFalsy();
 });
+
+test('getCommand', () => {
+  expect(getCommand('path', ['-v', '-x'], 'do-upload'))
+      .toEqual(['path', '-v', '-x', 'do-upload']);
+});
+
+test('setSafeDirectory', async () => {
+  process.env.GITHUB_WORKSPACE = 'testOrg/testRepo';
+  await setSafeDirectory();
+  const testSafeDirectory = ([
+    'git',
+    'config',
+    '--get',
+    'safe.directory',
+  ]).join(' ');
+  const safeDirectory = await exec.getExecOutput(testSafeDirectory);
+  expect(safeDirectory.stdout).toBe('testOrg/testRepo\n');
+});

src/helpers.ts

@@ -1,18 +1,26 @@
 import * as core from '@actions/core';
+import * as exec from '@actions/exec';
 
 const PLATFORMS = [
-  'aarch64',
-  'alpine',
   'linux',
   'macos',
   'windows',
-];
+  'alpine',
+  'linux-arm64',
+  'alpine-arm64',
+] as const;
+type Platform = typeof PLATFORMS[number];
 
 const setFailure = (message: string, failCi: boolean): void => {
-    failCi ? core.setFailed(message) : core.warning(message);
+  if (failCi) {
-    if (failCi) {
+    core.setFailed(message);
-      process.exit();
+  } else {
-    }
+    core.warning(message);
+  }
+
+  if (failCi) {
+    process.exit();
+  }
 };
 
 const getUploaderName = (platform: string): string => {
@@ -23,8 +31,8 @@ const getUploaderName = (platform: string): string => {
   }
 };
 
-const isValidPlatform = (platform: string): boolean => {
+const isValidPlatform = (platform: string): platform is Platform => {
-  return PLATFORMS.includes(platform);
+  return PLATFORMS.includes(platform as Platform);
 };
 
 const isWindows = (platform: string): boolean => {
@@ -50,7 +58,30 @@ const getPlatform = (os?: string): string => {
 };
 
 const getBaseUrl = (platform: string, version: string): string => {
-  return `https://uploader.codecov.io/${version}/${platform}/${getUploaderName(platform)}`;
+  return `https://cli.codecov.io/${version}/${platform}/${getUploaderName(platform)}`;
+};
+
+const getCommand = (
+    filename: string,
+    generalArgs:string[],
+    command: string,
+): string[] => {
+  const fullCommand = [filename, ...generalArgs, command];
+  core.info(`==> Running command '${fullCommand.join(' ')}'`);
+  return fullCommand;
+};
+
+const setSafeDirectory = async () => {
+  const command = ([
+    'git',
+    'config',
+    '--global',
+    '--add',
+    'safe.directory',
+    `${process.env['GITHUB_WORKSPACE']}`,
+  ].join(' '));
+  core.info(`==> Running ${command}`);
+  await exec.exec(command);
 };
 
 export {
@@ -61,4 +92,6 @@ export {
   isValidPlatform,
   isWindows,
   setFailure,
+  setSafeDirectory,
+  getCommand,
 };

src/index.ts

@@ -1,15 +1,22 @@
-import * as fs from 'fs';
+import * as fs from 'node:fs';
-import * as https from 'https';
+import * as https from 'node:https';
-import * as path from 'path';
+import * as path from 'node:path';
 
 import * as exec from '@actions/exec';
 
-import buildExec from './buildExec';
+import {
+  buildCommitExec,
+  buildGeneralExec,
+  buildReportExec,
+  buildUploadExec,
+} from './buildExec';
 import {
   getBaseUrl,
+  getCommand,
   getPlatform,
   getUploaderName,
   setFailure,
+  setSafeDirectory,
 } from './helpers';
 
 import verify from './validate';
@@ -17,49 +24,106 @@ import versionInfo from './version';
 
 let failCi;
 
-try {
+const run = async (): Promise<void> => {
-  const {execArgs, options, failCi, os, uploaderVersion, verbose} = buildExec();
+  try {
-  const platform = getPlatform(os);
+    const {commitExecArgs, commitOptions, commitCommand} = await buildCommitExec();
+    const {reportExecArgs, reportOptions, reportCommand} = await buildReportExec();
+    const {
+      uploadExecArgs,
+      uploadOptions,
+      disableSafeDirectory,
+      failCi,
+      os,
+      uploaderVersion,
+      uploadCommand,
+    } = await buildUploadExec();
+    const {args, verbose} = buildGeneralExec();
 
-  const filename = path.join( __dirname, getUploaderName(platform));
+    const platform = getPlatform(os);
-  https.get(getBaseUrl(platform, uploaderVersion), (res) => {
-    // Image will be stored at this path
-    const filePath = fs.createWriteStream(filename);
-    res.pipe(filePath);
-    filePath
-        .on('error', (err) => {
-          setFailure(
-              `Codecov: Failed to write uploader binary: ${err.message}`,
-              true,
-          );
-        }).on('finish', async () => {
-          filePath.close();
 
-          await verify(filename, platform, uploaderVersion, verbose, failCi);
+    const filename = path.join( __dirname, getUploaderName(platform));
-          await versionInfo(platform, uploaderVersion);
+    https.get(getBaseUrl(platform, uploaderVersion), (res) => {
-          await fs.chmodSync(filename, '777');
+      // Image will be stored at this path
+      const filePath = fs.createWriteStream(filename);
+      res.pipe(filePath);
+      filePath
+          .on('error', (err) => {
+            setFailure(
+                `Codecov: Failed to write uploader binary: ${err.message}`,
+                true,
+            );
+          }).on('finish', async () => {
+            filePath.close();
 
-          const unlink = () => {
+            await verify(filename, platform, uploaderVersion, verbose, failCi);
-            fs.unlink(filename, (err) => {
+            await versionInfo(platform, uploaderVersion);
-              if (err) {
+            await fs.chmodSync(filename, '777');
-                setFailure(
+            if (!disableSafeDirectory) {
-                    `Codecov: Could not unlink uploader: ${err.message}`,
+              await setSafeDirectory();
-                    failCi,
+            }
-                );
+
-              }
+            const unlink = (): void => {
-            });
+              fs.unlink(filename, (err) => {
-          };
+                if (err) {
-          await exec.exec(filename, execArgs, options)
+                  setFailure(
-              .catch((err) => {
+                      `Codecov: Could not unlink uploader: ${err.message}`,
-                setFailure(
+                      failCi,
-                    `Codecov: Failed to properly upload: ${err.message}`,
+                  );
-                    failCi,
+                }
-                );
-              }).then(() => {
-                unlink();
               });
-        });
+            };
-  });
+            const doUpload = async (): Promise<void> => {
-} catch (err) {
+              await exec.exec(getCommand(filename, args, uploadCommand).join(' '),
-  setFailure(`Codecov: Encountered an unexpected error ${err.message}`, failCi);
+                  uploadExecArgs,
-}
+                  uploadOptions)
+                  .catch((err) => {
+                    setFailure(
+                        `Codecov:
+                        Failed to properly upload report: ${err.message}`,
+                        failCi,
+                    );
+                  });
+            };
+            const createReport = async (): Promise<void> => {
+              await exec.exec(
+                  getCommand(filename, args, reportCommand).join(' '),
+                  reportExecArgs,
+                  reportOptions)
+                  .then(async (exitCode) => {
+                    if (exitCode == 0) {
+                      await doUpload();
+                    }
+                  }).catch((err) => {
+                    setFailure(
+                        `Codecov:
+                        Failed to properly create report: ${err.message}`,
+                        failCi,
+                    );
+                  });
+            };
+            await exec.exec(
+                getCommand(
+                    filename,
+                    args,
+                    commitCommand,
+                ).join(' '),
+                commitExecArgs, commitOptions)
+                .then(async (exitCode) => {
+                  if (exitCode == 0) {
+                    await createReport();
+                  }
+                  unlink();
+                }).catch((err) => {
+                  setFailure(
+                      `Codecov: Failed to properly create commit: ${err.message}`,
+                      failCi,
+                  );
+                });
+          });
+    });
+  } catch (err) {
+    setFailure(`Codecov: Encountered an unexpected error ${err.message}`, failCi);
+  }
+};
+
+run();

src/validate.ts

@@ -1,10 +1,10 @@
-import * as crypto from 'crypto';
+import {execSync} from 'node:child_process';
-import * as fs from 'fs';
+import * as crypto from 'node:crypto';
-import * as path from 'path';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
 
 import * as core from '@actions/core';
-import * as openpgp from 'openpgp';
+import {request} from 'undici';
-import * as fetch from 'node-fetch';
 
 import {
   getBaseUrl,
@@ -22,68 +22,97 @@ const verify = async (
   try {
     const uploaderName = getUploaderName(platform);
 
-    // Read in public key
-    const publicKeyArmored = await fs.readFileSync(
-        path.join(__dirname, 'pgp_keys.asc'),
-        'utf-8',
-    );
-
     // Get SHASUM and SHASUM signature files
     console.log(`${getBaseUrl(platform, version)}.SHA256SUM`);
-    const shasumRes = await fetch.default(
+    const shasumRes = await request(
         `${getBaseUrl(platform, version)}.SHA256SUM`,
     );
-    const shasum = await shasumRes.text();
+    const shasum = await shasumRes.body.text();
     if (verbose) {
       console.log(`Received SHA256SUM ${shasum}`);
     }
+    await fs.writeFileSync(
+        path.join(__dirname, `${uploaderName}.SHA256SUM`),
+        shasum,
+    );
 
-    const shaSigRes = await fetch.default(
+    const shaSigRes = await request(
         `${getBaseUrl(platform, version)}.SHA256SUM.sig`,
     );
-    const shaSig = await shaSigRes.text();
+    const shaSig = await shaSigRes.body.text();
     if (verbose) {
       console.log(`Received SHA256SUM signature ${shaSig}`);
     }
+    await fs.writeFileSync(
+        path.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
+        shaSig,
+    );
 
-    // Verify shasum
+    const validateSha = async () => {
-    const verified = await openpgp.verify({
+      const calculateHash = async (filename: string) => {
-      message: await openpgp.createMessage({text: shasum}),
+        const stream = fs.createReadStream(filename);
-      signature: await openpgp.readSignature({armoredSignature: shaSig}),
+        const uploaderSha = crypto.createHash(`sha256`);
-      verificationKeys: await openpgp.readKeys({armoredKeys: publicKeyArmored}),
+        stream.pipe(uploaderSha);
-    });
+
-    const valid = await verified.signatures[0].verified;
+        return new Promise((resolve, reject) => {
-    if (valid) {
+          stream.on('end', () => resolve(
-      core.info('==> SHASUM file signed by key id ' +
+              `${uploaderSha.digest('hex')}  ${uploaderName}`,
-          verified.signatures[0].keyID.toHex(),
+          ));
+          stream.on('error', reject);
+        });
+      };
+
+      const hash = await calculateHash(
+          path.join(__dirname, `${uploaderName}`),
       );
-    } else {
+      if (hash === shasum) {
-      setFailure('Codecov: Error validating SHASUM signature', failCi);
+        core.info(`==> Uploader SHASUM verified (${hash})`);
-    }
+      } else {
-
+        setFailure(
-    const calculateHash = async (filename: string) => {
+            'Codecov: Uploader shasum does not match -- ' +
-      const stream = fs.createReadStream(filename);
+              `uploader hash: ${hash}, public hash: ${shasum}`,
-      const uploaderSha = crypto.createHash(`sha256`);
+            failCi,
-      stream.pipe(uploaderSha);
+        );
-
+      }
-      return new Promise((resolve, reject) => {
-        stream.on('end', () => resolve(
-            `${uploaderSha.digest('hex')}  ${uploaderName}`,
-        ));
-        stream.on('error', reject);
-      });
     };
 
-    const hash = await calculateHash(filename);
+    const verifySignature = async () => {
-    if (hash === shasum) {
+      const command = [
-      core.info(`==> Uploader SHASUM verified (${hash})`);
+        'gpg',
-    } else {
+        '--logger-fd',
-      setFailure(
+        '1',
-          'Codecov: Uploader shasum does not match -- ' +
+        '--verify',
-            `uploader hash: ${hash}, public hash: ${shasum}`,
+        path.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
-          failCi,
+        path.join(__dirname, `${uploaderName}.SHA256SUM`),
-      );
+      ].join(' ');
-    }
+
+      try {
+        await execSync(command, {stdio: 'inherit'});
+      } catch (err) {
+        setFailure(`Codecov: Error verifying gpg signature: ${err.message}`, failCi);
+      }
+    };
+
+    const importKey = async () => {
+      const command = [
+        'gpg',
+        '--logger-fd',
+        '1',
+        '--no-default-keyring',
+        '--import',
+        path.join(__dirname, 'pgp_keys.asc'),
+      ].join(' ');
+
+      try {
+        await execSync(command, {stdio: 'inherit'});
+      } catch (err) {
+        setFailure(`Codecov: Error importing gpg key: ${err.message}`, failCi);
+      }
+    };
+
+    await importKey();
+    await verifySignature();
+    await validateSha();
   } catch (err) {
     setFailure(`Codecov: Error validating uploader: ${err.message}`, failCi);
   }

src/version.test.ts

@@ -0,0 +1,62 @@
+import * as core from '@actions/core';
+import {Agent, MockAgent, setGlobalDispatcher} from 'undici';
+
+import versionInfo from './version';
+
+const mockAgent = new MockAgent();
+
+beforeAll(() => {
+  setGlobalDispatcher(mockAgent);
+  mockAgent.disableNetConnect();
+});
+
+afterEach(() => {
+  jest.clearAllMocks();
+});
+
+afterAll(async () => {
+  await mockAgent.close();
+  setGlobalDispatcher(new Agent());
+});
+
+describe('versionInfo', () => {
+  const platform = 'linux';
+
+  test('should resolve requested version info', async () => {
+    const version = 'latest';
+    const coreInfoSpy = jest.spyOn(core, 'info');
+
+    mockAgent
+        .get('https://cli.codecov.io')
+        .intercept({
+          path: `/${platform}/${version}`,
+        })
+        .reply(200, {
+          version: 'v0.5.2',
+        });
+
+    await versionInfo(platform, version);
+
+    expect(coreInfoSpy).toHaveBeenCalledTimes(2);
+    expect(coreInfoSpy).toHaveBeenCalledWith('==> Running version latest');
+    expect(coreInfoSpy).toHaveBeenCalledWith('==> Running version v0.5.2');
+  });
+
+  test('should handle unsupported version', async () => {
+    const version = 'unsupported';
+    const coreInfoSpy = jest.spyOn(core, 'info');
+
+    mockAgent
+        .get('https://cli.codecov.io')
+        .intercept({
+          path: `/${platform}/${version}`,
+        })
+        .reply(404, 'MESSAGE');
+
+    await versionInfo(platform, version);
+
+    expect(coreInfoSpy).toHaveBeenCalledTimes(2);
+    expect(coreInfoSpy).toHaveBeenCalledWith('==> Running version unsupported');
+    expect(coreInfoSpy).toHaveBeenCalledWith(expect.stringContaining('Could not pull latest version information'));
+  });
+});

src/version.ts

@@ -1,19 +1,17 @@
 import * as core from '@actions/core';
-import * as fetch from 'node-fetch';
+import {request} from 'undici';
 
 const versionInfo = async (
     platform: string,
-    version?: string,
+    version: string,
 ): Promise<void> => {
-  if (version) {
+  core.info(`==> Running version ${version}`);
-    core.info(`==> Running version ${version}`);
-  }
 
   try {
-    const metadataRes = await fetch.default( `https://uploader.codecov.io/${platform}/latest`, {
+    const metadataRes = await request(`https://cli.codecov.io/${platform}/${version}`, {
       headers: {'Accept': 'application/json'},
     });
-    const metadata = await metadataRes.json();
+    const metadata = await metadataRes.body.json();
     core.info(`==> Running version ${metadata['version']}`);
   } catch (err) {
     core.info(`Could not pull latest version information: ${err}`);