chore(release): 4.4.0 (#1430)

Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 7.8.0 to 7.9.0.
- [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases)
- [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md)
- [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.9.0/packages/parser)

---
updated-dependencies:
- dependency-name: "@typescript-eslint/parser"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.eslintrc.json

@@ -17,6 +17,7 @@
         "@typescript-eslint"
     ],
     "rules": {
+        "max-len": ["error", { "code": 120 }],
         "linebreak-style": 0
     }
 }

.github/workflows/codeql-analysis.yml

@@ -12,10 +12,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main ]
   schedule:
     - cron: '24 6 * * 5'
 
@@ -37,11 +37,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4.1.1
+      uses: actions/checkout@v4.1.5
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3.23.2
+      uses: github/codeql-action/init@v3.25.4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -52,7 +52,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3.23.2
+      uses: github/codeql-action/autobuild@v3.25.4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -66,4 +66,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3.23.2
+      uses: github/codeql-action/analyze@v3.25.4

.github/workflows/enforce-license-compliance.yml

@@ -2,7 +2,7 @@ name: Enforce License Compliance
 
 on:
   pull_request:
-    branches: [main, master]
+    branches: [main]
 
 jobs:
   enforce-license-compliance:

.github/workflows/main.yml

@@ -8,7 +8,50 @@ jobs:
         os: [macos-latest, windows-latest, ubuntu-latest, macos-latest-xlarge]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@v4.1.5
+      - name: Install dependencies
+        run: npm install
+      - name: Lint
+        run: npm run lint
+      - name: Run tests and collect coverage
+        run: npm run test
+      - name: Upload coverage to Codecov (script)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/script/coverage-final.json
+          flags: script,${{ matrix.os }}
+          name: codecov-script
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (demo)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
+          file: ./coverage/coverage-final.json
+          flags: demo,${{ matrix.os }}
+          name: codecov-demo
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+      - name: Upload coverage to Codecov (version)
+        uses: ./
+        with:
+          fail_ci_if_error: true
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
+          file: ./coverage/coverage-final.json
+          flags: version,${{ matrix.os }}
+          name: codecov-version
+          version: v0.2.0
+          verbose: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+  run-container:
+    runs-on: ubuntu-latest
+    container: node:18
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4.1.5
       - name: Install dependencies
         run: npm install
       - name: Lint

.github/workflows/scorecards-analysis.yml

@@ -5,7 +5,7 @@ on:
   schedule:
     - cron: '43 20 * * 1'
   push:
-    branches: [ master ]
+    branches: [ main ]
 
 # Declare default permissions as read only.
 permissions: read-all
@@ -24,12 +24,12 @@ jobs:
     
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@v4.1.1 # v3.0.0
+        uses: actions/checkout@v4.1.5 # v3.0.0
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
+        uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -48,7 +48,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: SARIF file
           path: results.sarif
@@ -56,6 +56,6 @@ jobs:
       
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3.23.2 # v1.0.26
+        uses: github/codeql-action/upload-sarif@v3.25.4 # v1.0.26
         with:
           sarif_file: results.sarif

README.md

@@ -1,6 +1,6 @@
 # Codecov GitHub Action
 
-[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-v3-undefined.svg?logo=github&logoColor=white&style=flat)](https://github.com/marketplace/actions/codecov)
+[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-v4-undefined.svg?logo=github&logoColor=white&style=flat)](https://github.com/marketplace/actions/codecov)
 [![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fcodecov%2Fcodecov-action.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Fcodecov%2Fcodecov-action?ref=badge_shield)
 [![Workflow for Codecov Action](https://github.com/codecov/codecov-action/actions/workflows/main.yml/badge.svg)](https://github.com/codecov/codecov-action/actions/workflows/main.yml)
 ### Easily upload coverage reports to Codecov from GitHub Actions
@@ -8,10 +8,13 @@
 ## v4 Release
 `v4` of the Codecov GitHub Action will use the [Codecov CLI](https://github.com/codecov/codecov-cli) to upload coverage reports to Codecov.
 
-Breaking Changes
+### Breaking Changes
-- Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token)
+- Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token). For details, [see our docs](https://docs.codecov.com/docs/codecov-uploader#supporting-token-less-uploads-for-forks-of-open-source-repos-using-codecov)
 - Various arguments to the Action have been removed
 
+### Dependabot
+- For repositories using `Dependabot`, users will need to ensure that it has access to the Codecov token for PRs from Dependabot to upload coverage. To do this, please add your `CODECOV_TOKEN` as a Dependabot Secret. For more information, see ["Configuring access to private registries for Dependabot."](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#storing-credentials-for-dependabot-to-use)
+
 `v3` versions and below will not have access to CLI features (e.g. global upload token, ATS).
 
 ## Usage
@@ -32,7 +35,7 @@ Inside your `.github/workflows/workflow.yml` file:
 
 ```yaml
 steps:
-- uses: actions/checkout@master
+- uses: actions/checkout@main
 - uses: codecov/codecov-action@v4
   with:
     fail_ci_if_error: true # optional (default = false)
@@ -47,7 +50,7 @@ The Codecov token can also be passed in via environment variables:
 
 ```yaml
 steps:
-- uses: actions/checkout@master
+- uses: actions/checkout@main
 - uses: codecov/codecov-action@v4
   with:
     fail_ci_if_error: true # optional (default = false)
@@ -58,53 +61,59 @@ steps:
   env:
     CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 ```
->**Note**: This assumes that you've set your Codecov token inside *Settings > Secrets* as `CODECOV_TOKEN`. If not, you can [get an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) for your specific repo on [codecov.io](https://www.codecov.io). Keep in mind that secrets are *not* available to forks of repositories.
+> [!NOTE]
+> This assumes that you've set your Codecov token inside *Settings > Secrets* as `CODECOV_TOKEN`. If not, you can [get an upload token](https://docs.codecov.io/docs/frequently-asked-questions#section-where-is-the-repository-upload-token-found-) for your specific repo on [codecov.io](https://www.codecov.io). Keep in mind that secrets are *not* available to forks of repositories.
+
+### Using OIDC
+For users with [OpenID Connect(OIDC) enabled](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect), the Codecov token is not necessary. You can use OIDC with the `use_oidc` argument as following.
+
+```yaml
+- uses: codecov/codecov-action@v4
+  with:
+    use_oidc: true
+```
+
+Any token supplied will be ignored, as Codecov will default to the OIDC token for verification.
 
 ## Arguments
 
 Codecov's Action supports inputs from the user. These inputs, along with their descriptions and usage contexts, are listed in the table below:
 
-| Input  | Description | Usage |
+| Input  | Description | Required |
-| :---:     |     :---:   |    :---:   |
+| :---       |     :---     |    :---:   |
-| `token`  | Used to authorize coverage report uploads  | *Required |
+| `token` | Repository Codecov token. Used to authorize report uploads | *Required
-| `move_coverage_to_trash` | Move discovered coverage reports to the trash | Optional
+| `codecov_yml_path` | Specify the path to the Codecov YML | Optional
-| `commit_parent` | The commit SHA of the parent for which you are uploading coverage. If not present, the parent will be determined using the API of your repository provider.  When using the repository provider's API, the parent is determined via finding the closest ancestor to the commit. | Optional
+| `commit_parent` | Override to specify the parent commit SHA | Optional
+| `directory` | Directory to search for coverage reports. | Optional
+| `disable_search` | Disable search for coverage files. This is helpful when specifying what files you want to upload with the --file option. | Optional
+| `disable_file_fixes` | Disable file fixes to ignore common lines from coverage (e.g. blank lines or empty brackets) | Optional
 | `dry_run` | Don't upload files to Codecov | Optional
-| `env_vars`  | Environment variables to tag the upload with. Multiple env variables can be separated with commas (e.g. `OS,PYTHON`) | Optional
+| `env_vars` | Environment variables to tag the upload with (e.g. PYTHON \| OS,PYTHON) | Optional
-| `fail_ci_if_error`  | Specify if CI pipeline should fail when Codecov runs into errors during upload. *Defaults to **false*** | Optional
+| `exclude` | Folders to exclude from search | Optional
-| `files`  | Comma-separated paths to the coverage report(s). Negated paths are supported by starting with `!` | Optional
+| `fail_ci_if_error` | Specify whether or not CI build should fail if Codecov runs into an error during upload | Optional
-| `flags`  | Flag the upload to group coverage metrics (unittests, uitests, etc.). Multiple flags are separated by a comma (ui,chrome) | Optional
+| `file` | Path to coverage file to upload | Optional
-| `full_report` | Specify the path of a full Codecov report to re-upload | Optional
+| `files` | Comma-separated list of files to upload | Optional
-| `functionalities` | Toggle functionalities | Optional
+| `flags` | Flag upload to group coverage metrics (e.g. unittests \| integration \| ui,chrome) | Optional
-| -- `network` | Disable uploading the file network | Optional
+| `handle_no_reports_found` | Raise no exceptions when no coverage reports found | Optional
-| -- `fixes` | Enable file fixes to ignore common lines from coverage | Optional
+| `job_code` | The job code | Optional
-| -- `search` | Disable searching for coverage files | Optional
+| `name` | User defined upload name. Visible in Codecov UI | Optional
-| `gcov` | Run with gcov support | Optional
+| `os` | Override the assumed OS. Options are linux \| macos \| windows \| . | Optional
-| `gcov_args` | Extra arguments to pass to gcov | Optional
-| `gcov_ignore` | Paths to ignore during gcov gathering | Optional
-| `gcov_include` | Paths to include during gcov gathering | Optional
-| `gcov_executable` | gcov executable to run. Defaults to gcov. | Optional
-| `name`  | Custom defined name for the upload | Optional
-| `network_filter` | Specify a filter on the files listed in the network section of the Codecov report. Useful for upload-specific path fixing | Optional
-| `network_prefix` | Specify a prefix on files listed in the network section of the Codecov report. Useful to help resolve path fixing | Optional
-| `os` | Specify the OS (linux, macos, windows, alpine) | Optional
 | `override_branch` | Specify the branch name | Optional
 | `override_build` | Specify the build number | Optional
+| `override_build_url` | The URL of the build where this is running | Optional
 | `override_commit` | Specify the commit SHA | Optional
 | `override_pr` | Specify the pull request number | Optional
-| `override_tag` | Specify the git tag | Optional
+| `plugin` | plugins to run. Options: xcode, gcov, pycoverage. The default behavior runs them all. | Optional
-| `root_dir` | Used when not in git/hg project to identify project root directory | Optional
+| `plugins` | Comma-separated list of plugins for use during upload. | Optional
-| `directory` | Directory to search for coverage reports. | Optional
+| `report_code` | The code of the report. If unsure, do not include | Optional
+| `root_dir` | Used to specify the location of your   .git   root to identify project root directory | Optional
 | `slug` | Specify the slug manually (Enterprise use) | Optional
-| `swift` | Run with swift coverage support | Optional
+| `url` | Specify the base url to upload (Enterprise use) | Optional
-| -- `swift_project` | Specify the swift project to speed up coverage conversion | Optional
+| `use_legacy_upload_endpoint` | Use the legacy upload endpoint | Optional
-| `upstream_proxy` | The upstream http proxy server to connect through | Optional
+| `use_oidc` | Use OpenID Connect for verification instead of token. This will ignore any token supplied. Please see [GitHub documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect) for details.
-| `url` | Change the upload host (Enterprise use) | Optional
 | `verbose` | Specify whether the Codecov output should be verbose | Optional
-| `version` | Specify which version of the Codecov Uploader should be used. Defaults to `latest` | Optional
+| `version` | Specify which version of the Codecov CLI should be used. Defaults to `latest` | Optional
-| `working-directory` | Directory in which to execute `codecov.sh` | Optional
+| `working-directory` | Directory in which to execute codecov.sh | Optional
-| `xtra_args` | Add additional uploader args that may be missing in the Action | Optional
-
 
 ### Example `workflow.yml` with Codecov Action
 
@@ -121,9 +130,9 @@ jobs:
       OS: ${{ matrix.os }}
       PYTHON: '3.10'
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@main
     - name: Setup Python
-      uses: actions/setup-python@master
+      uses: actions/setup-python@main
       with:
         python-version: 3.10
     - name: Generate coverage report

action.yml

@@ -3,7 +3,7 @@ description: 'GitHub Action that uploads coverage reports for your repository to
 author: 'Ibrahim Ali <@ibrahim0814> & Thomas Hu <@thomasrockhu> | Codecov'
 inputs:
   token:
-    description: 'Repository upload token - get it from codecov.io. Required only for private repositories'
+    description: 'Repository Codecov token. Used to authorize report uploads'
     required: false
   codecov_yml_path:
     description: 'Specify the path to the Codecov YML'
@@ -14,11 +14,14 @@ inputs:
   directory:
     description: 'Directory to search for coverage reports.'
     required: false
+  disable_file_fixes:
+    description: 'Disable file fixes to ignore common lines from coverage (e.g. blank lines or empty brackets)'
+    required: false
   disable_search:
     description: 'Disable search for coverage files. This is helpful when specifying what files you want to upload with the --file option.'
     required: false
-  disable_file_fixes:
+  disable_safe_directory:
-    description: 'Disable file fixes to ignore common lines from coverage (e.g. blank lines or empty brackets)'
+    description: 'Disable setting safe directory. Set to true to disable.'
     required: false
   dry_run:
     description: "Don't upload files to Codecov"
@@ -41,6 +44,9 @@ inputs:
   flags:
     description: 'Flag upload to group coverage metrics (e.g. unittests | integration | ui,chrome)'
     required: false
+  git_service:
+    description: 'Override the git_service (e.g. github_enterprise)'
+    required: false
   handle_no_reports_found:
     description: 'Raise no exceptions when no coverage reports found'
     required: false
@@ -50,6 +56,12 @@ inputs:
   name:
     description: 'User defined upload name. Visible in Codecov UI'
     required: false
+  network_filter:
+    description: 'Specify a filter on the files listed in the network section of the Codecov report. This will only add files whose path begin with the specified filter. Useful for upload-specific path fixing'
+    required: false
+  network_prefix:
+    description: 'Specify a prefix on files listed in the network section of the Codecov report. Useful to help resolve path fixing'
+    required: false
   os:
     description: 'Override the assumed OS. Options are linux | macos | windows.'
     required: false
@@ -89,6 +101,9 @@ inputs:
   use_legacy_upload_endpoint:
     description: 'Use the legacy upload endpoint'
     required: false
+  use_oidc:
+    description: 'Use OIDC instead of token. This will ignore any token supplied'
+    required: false
   verbose:
     description: 'Specify whether the Codecov output should be verbose'
     required: false

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codecov-action",
-  "version": "4.0.1",
+  "version": "4.4.0",
   "description": "Upload coverage reports to Codecov from GitHub Actions",
   "main": "index.js",
   "scripts": {
@@ -26,19 +26,18 @@
     "@actions/core": "^1.10.1",
     "@actions/exec": "^1.1.1",
     "@actions/github": "^6.0.0",
-    "gpg": "^0.6.0",
+    "undici": "5.28.4"
-    "undici": "5.28.2"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.11",
+    "@types/jest": "^29.5.12",
-    "@typescript-eslint/eslint-plugin": "^6.20.0",
+    "@typescript-eslint/eslint-plugin": "^7.8.0",
-    "@typescript-eslint/parser": "^6.20.0",
+    "@typescript-eslint/parser": "^7.9.0",
     "@vercel/ncc": "^0.38.1",
-    "eslint": "^8.56.0",
+    "eslint": "^8.57.0",
     "eslint-config-google": "^0.14.0",
     "jest": "^29.7.0",
     "jest-junit": "^16.0.0",
     "ts-jest": "^29.1.2",
-    "typescript": "^5.3.3"
+    "typescript": "^5.4.5"
   }
 }

src/buildExec.test.ts

@@ -7,10 +7,20 @@ import {
   buildUploadExec,
 } from './buildExec';
 
-
 const context = github.context;
 
-test('general args', () => {
+let OLDOS = process.env.RUNNER_OS;
+
+beforeEach(() => {
+  jest.resetModules();
+  OLDOS = process.env.RUNNER_OS;
+});
+
+afterAll(() => {
+  process.env.RUNNER_OS = OLDOS;
+});
+
+test('general args', async () => {
   const envs = {
     codecov_yml_path: 'dev/codecov.yml',
     url: 'https://codecov.enterprise.com',
@@ -20,7 +30,7 @@ test('general args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {args, verbose} = buildGeneralExec();
+  const {args, verbose} = await buildGeneralExec();
 
   expect(args).toEqual(
       expect.arrayContaining([
@@ -36,12 +46,14 @@ test('general args', () => {
   }
 });
 
-
+test('upload args using context', async () => {
-test('upload args using context', () => {
+  const expectedArgs = [
-  const expectedArgs = [];
+    '--git-service',
-  const {uploadExecArgs, uploadCommand} = buildUploadExec();
+    'github',
+  ];
+  const {uploadExecArgs, uploadCommand} = await buildUploadExec();
   if (context.eventName == 'pull_request') {
-    expectedArgs.push('-C', `${context.payload.pull_request.head.sha}`);
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
   }
   if (context.eventName == 'pull_request_target') {
     expectedArgs.push('-P', `${context.payload.number}`);
@@ -51,7 +63,7 @@ test('upload args using context', () => {
   expect(uploadCommand).toEqual('do-upload');
 });
 
-test('upload args', () => {
+test('upload args', async () => {
   const envs = {
     'codecov_yml_path': 'dev/codecov.yml',
     'commit_parent': 'fakeparentcommit',
@@ -65,6 +77,7 @@ test('upload args', () => {
     'file': 'coverage.xml',
     'files': 'dir1/coverage.xml,dir2/coverage.xml',
     'flags': 'test,test2',
+    'git_service': 'github_enterprise',
     'handle_no_reports_found': 'true',
     'job_code': '32',
     'name': 'codecov',
@@ -74,6 +87,8 @@ test('upload args', () => {
     'override_build_url': 'https://example.com/build/2',
     'override_commit': '9caabca5474b49de74ef5667deabaf74cdacc244',
     'override_pr': '2',
+    'network_filter': 'subA/',
+    'network_prefix': 'forA/',
     'plugin': 'xcode',
     'plugins': 'pycoverage,compress-pycoverage',
     'report_code': 'testCode',
@@ -90,7 +105,7 @@ test('upload args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {uploadExecArgs, uploadCommand} = buildUploadExec();
+  const {uploadExecArgs, uploadCommand} = await buildUploadExec();
   const expectedArgs = [
     '--disable-file-fixes',
     '--disable-search',
@@ -110,11 +125,17 @@ test('upload args', () => {
     'test',
     '-F',
     'test2',
+    '--git-service',
+    'github_enterprise',
     '--handle-no-reports-found',
     '--job-code',
     '32',
     '-n',
     'codecov',
+    '--network-filter',
+    'subA/',
+    '--network-prefix',
+    'forA/',
     '-B',
     'thomasrockhu/test',
     '-b',
@@ -150,8 +171,9 @@ test('upload args', () => {
 });
 
 
-test('report args', () => {
+test('report args', async () => {
   const envs = {
+    git_service: 'github_enterprise',
     override_commit: '9caabca5474b49de74ef5667deabaf74cdacc244',
     override_pr: 'fakePR',
     slug: 'fakeOwner/fakeRepo',
@@ -162,9 +184,11 @@ test('report args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {reportExecArgs, reportCommand} = buildReportExec();
+  const {reportExecArgs, reportCommand} = await buildReportExec();
 
   const expectedArgs = [
+    '--git-service',
+    'github_enterprise',
     '-C',
     '9caabca5474b49de74ef5667deabaf74cdacc244',
     '-P',
@@ -182,19 +206,22 @@ test('report args', () => {
 });
 
 
-test('report args using context', () => {
+test('report args using context', async () => {
   const envs = {
     token: 'd3859757-ab80-4664-924d-aef22fa7557b',
   };
   for (const env of Object.keys(envs)) {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
-  const expectedArgs : string[] = [];
+  const expectedArgs : string[] = [
+    '--git-service',
+    'github',
+  ];
   if (context.eventName == 'pull_request') {
-    expectedArgs.push('-C', `${context.payload.pull_request.head.sha}`);
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
   }
 
-  const {reportExecArgs, reportCommand} = buildReportExec();
+  const {reportExecArgs, reportCommand} = await buildReportExec();
 
   expect(reportExecArgs).toEqual(expectedArgs);
   expect(reportCommand).toEqual('create-report');
@@ -204,8 +231,9 @@ test('report args using context', () => {
 });
 
 
-test('commit args', () => {
+test('commit args', async () => {
   const envs = {
+    git_service: 'github_enterprise',
     commit_parent: '83231650328f11695dfb754ca0f540516f188d27',
     override_branch: 'thomasrockhu/test',
     override_commit: '9caabca5474b49de74ef5667deabaf74cdacc244',
@@ -218,10 +246,12 @@ test('commit args', () => {
     process.env['INPUT_' + env.toUpperCase()] = envs[env];
   }
 
-  const {commitExecArgs, commitCommand} = buildCommitExec();
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
   const expectedArgs = [
     '--parent-sha',
     '83231650328f11695dfb754ca0f540516f188d27',
+    '--git-service',
+    'github_enterprise',
     '-B',
     'thomasrockhu/test',
     '-C',
@@ -240,12 +270,35 @@ test('commit args', () => {
   }
 });
 
-test('commit args using context', () => {
+test('commit args using context', async () => {
-  const expectedArgs :string[] = [];
+  const expectedArgs :string[] = [
+    '--git-service',
+    'github',
+  ];
 
-  const {commitExecArgs, commitCommand} = buildCommitExec();
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
   if (context.eventName == 'pull_request') {
-    expectedArgs.push('-C', `${context.payload.pull_request.head.sha}`);
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
+  }
+  if (context.eventName == 'pull_request_target') {
+    expectedArgs.push('-P', `${context.payload.number}`);
+  }
+
+  expect(commitExecArgs).toEqual(expectedArgs);
+  expect(commitCommand).toEqual('create-commit');
+});
+
+test('commit args using github server url', async () => {
+  const expectedArgs :string[] = [
+    '--git-service',
+    'github_enterprise',
+  ];
+
+  process.env.GITHUB_SERVER_URL = 'https://example.com';
+
+  const {commitExecArgs, commitCommand} = await buildCommitExec();
+  if (context.eventName == 'pull_request') {
+    expectedArgs.push('-C', `${context.payload.pull_request?.head.sha}`);
   }
   if (context.eventName == 'pull_request_target') {
     expectedArgs.push('-P', `${context.payload.number}`);

src/buildExec.ts

@@ -3,10 +3,11 @@
 import * as core from '@actions/core';
 import * as github from '@actions/github';
 
+import {setFailure} from './helpers';
 
 const context = github.context;
 
-const isTrue = (variable) => {
+const isTrue = (variable: string): boolean => {
   const lowercase = variable.toLowerCase();
   return (
     lowercase === '1' ||
@@ -17,15 +18,71 @@ const isTrue = (variable) => {
   );
 };
 
+const getGitService = (): string => {
+  const overrideGitService = core.getInput('git_service');
+  const serverUrl = process.env.GITHUB_SERVER_URL;
+  if (overrideGitService) {
+    return overrideGitService;
+  } else if (serverUrl !== undefined && serverUrl !== 'https://github.com') {
+    return 'github_enterprise';
+  }
+  return 'github';
+};
 
-const buildCommitExec = () => {
+const isPullRequestFromFork = (): boolean => {
+  if (
+    `${context.eventName}` !== 'pull_request' ||
+    `${context.eventName}` !== 'pull_request_target'
+  ) {
+    return false;
+  }
+
+  const baseLabel = context.payload.pull_request.base.label;
+  const headLabel = context.payload.pull_request.head.label;
+
+  core.info(`baseRef: ${baseLabel} | headRef: ${headLabel}`);
+  return (baseLabel.split(':')[0] !== headLabel.split(':')[0]);
+};
+
+const getToken = async (): Promise<string> => {
+  if (isPullRequestFromFork()) {
+    core.info('==> Fork detected, tokenless uploading used');
+    return Promise.resolve('');
+  }
+  let token = core.getInput('token');
+  let url = core.getInput('url');
+  const useOIDC = isTrue(core.getInput('use_oidc'));
+  if (useOIDC) {
+    if (!url) {
+      url = 'https://codecov.io';
+    }
+    try {
+      token = await core.getIDToken(url);
+      return token;
+    } catch (err) {
+      setFailure(
+          `Codecov: Failed to get OIDC token with url: ${url}. ${err.message}`,
+          true,
+      );
+    }
+  }
+  return token;
+};
+
+const buildCommitExec = async (): Promise<{
+  commitExecArgs: any[];
+  commitOptions: any;
+  commitCommand: string;
+}> => {
   const commitParent = core.getInput('commit_parent');
+  const gitService = getGitService();
   const overrideBranch = core.getInput('override_branch');
   const overrideCommit = core.getInput('override_commit');
   const overridePr = core.getInput('override_pr');
   const slug = core.getInput('slug');
-  const token = core.getInput('token');
+  const token = await getToken();
   const failCi = isTrue(core.getInput('fail_ci_if_error'));
+  const workingDir = core.getInput('working-directory');
 
   const commitCommand = 'create-commit';
   const commitExecArgs = [];
@@ -47,6 +104,7 @@ const buildCommitExec = () => {
   if (commitParent) {
     commitExecArgs.push('--parent-sha', `${commitParent}`);
   }
+  commitExecArgs.push('--git-service', `${gitService}`);
 
   if (overrideBranch) {
     commitExecArgs.push('-B', `${overrideBranch}`);
@@ -72,12 +130,18 @@ const buildCommitExec = () => {
   if (failCi) {
     commitExecArgs.push('-Z');
   }
+  if (workingDir) {
+    commitOptions.cwd = workingDir;
+  }
 
 
   return {commitExecArgs, commitOptions, commitCommand};
 };
 
-const buildGeneralExec = () => {
+const buildGeneralExec = (): {
+  args: any[];
+  verbose: boolean;
+} => {
   const codecovYmlPath = core.getInput('codecov_yml_path');
   const url = core.getInput('url');
   const verbose = isTrue(core.getInput('verbose'));
@@ -95,12 +159,18 @@ const buildGeneralExec = () => {
   return {args, verbose};
 };
 
-const buildReportExec = () => {
+const buildReportExec = async (): Promise<{
+  reportExecArgs: any[];
+  reportOptions: any;
+  reportCommand: string;
+}> => {
+  const gitService = getGitService();
   const overrideCommit = core.getInput('override_commit');
   const overridePr = core.getInput('override_pr');
   const slug = core.getInput('slug');
-  const token = core.getInput('token');
+  const token = await getToken();
   const failCi = isTrue(core.getInput('fail_ci_if_error'));
+  const workingDir = core.getInput('working-directory');
 
 
   const reportCommand = 'create-report';
@@ -120,6 +190,8 @@ const buildReportExec = () => {
   if (token) {
     reportOptions.env.CODECOV_TOKEN = token;
   }
+  reportExecArgs.push('--git-service', `${gitService}`);
+
   if (overrideCommit) {
     reportExecArgs.push('-C', `${overrideCommit}`);
   } else if (
@@ -141,12 +213,24 @@ const buildReportExec = () => {
   if (failCi) {
     reportExecArgs.push('-Z');
   }
+  if (workingDir) {
+    reportOptions.cwd = workingDir;
+  }
 
   return {reportExecArgs, reportOptions, reportCommand};
 };
 
-const buildUploadExec = () => {
+const buildUploadExec = async (): Promise<{
+  uploadExecArgs: any[];
+  uploadOptions: any;
+  disableSafeDirectory: boolean;
+  failCi: boolean;
+  os: string;
+  uploaderVersion: string;
+  uploadCommand: string;
+}> => {
   const disableFileFixes = isTrue(core.getInput('disable_file_fixes'));
+  const disableSafeDirectory = isTrue(core.getInput('disable_safe_directory'));
   const disableSearch = isTrue(core.getInput('disable_search'));
   const dryRun = isTrue(core.getInput('dry_run'));
   const envVars = core.getInput('env_vars');
@@ -155,9 +239,12 @@ const buildUploadExec = () => {
   const file = core.getInput('file');
   const files = core.getInput('files');
   const flags = core.getInput('flags');
+  const gitService = getGitService();
   const handleNoReportsFound = isTrue(core.getInput('handle_no_reports_found'));
   const jobCode = core.getInput('job_code');
   const name = core.getInput('name');
+  const networkFilter = core.getInput('network_filter');
+  const networkPrefix = core.getInput('network_prefix');
   const os = core.getInput('os');
   const overrideBranch = core.getInput('override_branch');
   const overrideBuild = core.getInput('override_build');
@@ -170,7 +257,7 @@ const buildUploadExec = () => {
   const rootDir = core.getInput('root_dir');
   const searchDir = core.getInput('directory');
   const slug = core.getInput('slug');
-  const token = core.getInput('token');
+  const token = await getToken();
   let uploaderVersion = core.getInput('version');
   const useLegacyUploadEndpoint = isTrue(
       core.getInput('use_legacy_upload_endpoint'),
@@ -231,6 +318,7 @@ const buildUploadExec = () => {
       uploadExecArgs.push('-F', `${f}`);
     });
   }
+  uploadExecArgs.push('--git-service', `${gitService}`);
   if (handleNoReportsFound) {
     uploadExecArgs.push('--handle-no-reports-found');
   }
@@ -240,6 +328,12 @@ const buildUploadExec = () => {
   if (name) {
     uploadExecArgs.push('-n', `${name}`);
   }
+  if (networkFilter) {
+    uploadExecArgs.push('--network-filter', `${networkFilter}`);
+  }
+  if (networkPrefix) {
+    uploadExecArgs.push('--network-prefix', `${networkPrefix}`);
+  }
   if (overrideBranch) {
     uploadExecArgs.push('-B', `${overrideBranch}`);
   }
@@ -297,6 +391,7 @@ const buildUploadExec = () => {
   return {
     uploadExecArgs,
     uploadOptions,
+    disableSafeDirectory,
     failCi,
     os,
     uploaderVersion,

src/helpers.test.ts

@@ -1,10 +1,13 @@
+import * as exec from '@actions/exec';
+
 import {
+  PLATFORMS,
   getBaseUrl,
+  getCommand,
   getPlatform,
   isValidPlatform,
   isWindows,
-  PLATFORMS,
+  setSafeDirectory,
-  getCommand,
 } from './helpers';
 
 let OLDOS = process.env.RUNNER_OS;
@@ -78,3 +81,16 @@ test('getCommand', () => {
   expect(getCommand('path', ['-v', '-x'], 'do-upload'))
       .toEqual(['path', '-v', '-x', 'do-upload']);
 });
+
+test('setSafeDirectory', async () => {
+  process.env.GITHUB_WORKSPACE = 'testOrg/testRepo';
+  await setSafeDirectory();
+  const testSafeDirectory = ([
+    'git',
+    'config',
+    '--get',
+    'safe.directory',
+  ]).join(' ');
+  const safeDirectory = await exec.getExecOutput(testSafeDirectory);
+  expect(safeDirectory.stdout).toBe('testOrg/testRepo\n');
+});

src/helpers.ts

@@ -1,4 +1,5 @@
 import * as core from '@actions/core';
+import * as exec from '@actions/exec';
 
 const PLATFORMS = [
   'linux',
@@ -7,7 +8,8 @@ const PLATFORMS = [
   'alpine',
   'linux-arm64',
   'alpine-arm64',
-];
+] as const;
+type Platform = typeof PLATFORMS[number];
 
 const setFailure = (message: string, failCi: boolean): void => {
     failCi ? core.setFailed(message) : core.warning(message);
@@ -24,8 +26,8 @@ const getUploaderName = (platform: string): string => {
   }
 };
 
-const isValidPlatform = (platform: string): boolean => {
+const isValidPlatform = (platform: string): platform is Platform => {
-  return PLATFORMS.includes(platform);
+  return PLATFORMS.includes(platform as Platform);
 };
 
 const isWindows = (platform: string): boolean => {
@@ -64,6 +66,19 @@ const getCommand = (
   return fullCommand;
 };
 
+const setSafeDirectory = async () => {
+  const command = ([
+    'git',
+    'config',
+    '--global',
+    '--add',
+    'safe.directory',
+    `${process.env['GITHUB_WORKSPACE']}`,
+  ].join(' '));
+  core.info(`==> Running ${command}`);
+  await exec.exec(command);
+};
+
 export {
   PLATFORMS,
   getBaseUrl,
@@ -72,5 +87,6 @@ export {
   isValidPlatform,
   isWindows,
   setFailure,
+  setSafeDirectory,
   getCommand,
 };

src/index.ts

@@ -1,6 +1,6 @@
-import * as fs from 'fs';
+import * as fs from 'node:fs';
-import * as https from 'https';
+import * as https from 'node:https';
-import * as path from 'path';
+import * as path from 'node:path';
 
 import * as exec from '@actions/exec';
 
@@ -12,10 +12,11 @@ import {
 } from './buildExec';
 import {
   getBaseUrl,
+  getCommand,
   getPlatform,
   getUploaderName,
   setFailure,
-  getCommand,
+  setSafeDirectory,
 } from './helpers';
 
 import verify from './validate';
@@ -23,98 +24,106 @@ import versionInfo from './version';
 
 let failCi;
 
-try {
+const run = async (): Promise<void> => {
-  const {commitExecArgs, commitOptions, commitCommand} = buildCommitExec();
+  try {
-  const {reportExecArgs, reportOptions, reportCommand} = buildReportExec();
+    const {commitExecArgs, commitOptions, commitCommand} = await buildCommitExec();
-  const {
+    const {reportExecArgs, reportOptions, reportCommand} = await buildReportExec();
-    uploadExecArgs,
+    const {
-    uploadOptions,
+      uploadExecArgs,
-    failCi,
+      uploadOptions,
-    os,
+      disableSafeDirectory,
-    uploaderVersion,
+      failCi,
-    uploadCommand,
+      os,
-  } = buildUploadExec();
+      uploaderVersion,
-  const {args, verbose} = buildGeneralExec();
+      uploadCommand,
+    } = await buildUploadExec();
+    const {args, verbose} = buildGeneralExec();
 
-  const platform = getPlatform(os);
+    const platform = getPlatform(os);
 
-  const filename = path.join( __dirname, getUploaderName(platform));
+    const filename = path.join( __dirname, getUploaderName(platform));
-  https.get(getBaseUrl(platform, uploaderVersion), (res) => {
+    https.get(getBaseUrl(platform, uploaderVersion), (res) => {
-    // Image will be stored at this path
+      // Image will be stored at this path
-    const filePath = fs.createWriteStream(filename);
+      const filePath = fs.createWriteStream(filename);
-    res.pipe(filePath);
+      res.pipe(filePath);
-    filePath
+      filePath
-        .on('error', (err) => {
+          .on('error', (err) => {
-          setFailure(
+            setFailure(
-              `Codecov: Failed to write uploader binary: ${err.message}`,
+                `Codecov: Failed to write uploader binary: ${err.message}`,
-              true,
+                true,
-          );
+            );
-        }).on('finish', async () => {
+          }).on('finish', async () => {
-          filePath.close();
+            filePath.close();
 
-          await verify(filename, platform, uploaderVersion, verbose, failCi);
+            await verify(filename, platform, uploaderVersion, verbose, failCi);
-          await versionInfo(platform, uploaderVersion);
+            await versionInfo(platform, uploaderVersion);
-          await fs.chmodSync(filename, '777');
+            await fs.chmodSync(filename, '777');
+            if (!disableSafeDirectory) {
+              await setSafeDirectory();
+            }
 
-          const unlink = () => {
+            const unlink = (): void => {
-            fs.unlink(filename, (err) => {
+              fs.unlink(filename, (err) => {
-              if (err) {
+                if (err) {
-                setFailure(
-                    `Codecov: Could not unlink uploader: ${err.message}`,
-                    failCi,
-                );
-              }
-            });
-          };
-          const doUpload = async () => {
-            await exec.exec(getCommand(filename, args, uploadCommand).join(' '),
-                uploadExecArgs,
-                uploadOptions)
-                .catch((err) => {
                   setFailure(
-                      `Codecov: 
+                      `Codecov: Could not unlink uploader: ${err.message}`,
-                      Failed to properly upload report: ${err.message}`,
                       failCi,
                   );
-                });
+                }
-          };
+              });
-          const createReport = async () => {
+            };
+            const doUpload = async (): Promise<void> => {
+              await exec.exec(getCommand(filename, args, uploadCommand).join(' '),
+                  uploadExecArgs,
+                  uploadOptions)
+                  .catch((err) => {
+                    setFailure(
+                        `Codecov:
+                        Failed to properly upload report: ${err.message}`,
+                        failCi,
+                    );
+                  });
+            };
+            const createReport = async (): Promise<void> => {
+              await exec.exec(
+                  getCommand(filename, args, reportCommand).join(' '),
+                  reportExecArgs,
+                  reportOptions)
+                  .then(async (exitCode) => {
+                    if (exitCode == 0) {
+                      await doUpload();
+                    }
+                  }).catch((err) => {
+                    setFailure(
+                        `Codecov:
+                        Failed to properly create report: ${err.message}`,
+                        failCi,
+                    );
+                  });
+            };
             await exec.exec(
-                getCommand(filename, args, reportCommand).join(' '),
+                getCommand(
-                reportExecArgs,
+                    filename,
-                reportOptions)
+                    args,
+                    commitCommand,
+                ).join(' '),
+                commitExecArgs, commitOptions)
                 .then(async (exitCode) => {
                   if (exitCode == 0) {
-                    await doUpload();
+                    await createReport();
                   }
+                  unlink();
                 }).catch((err) => {
                   setFailure(
-                      `Codecov: 
+                      `Codecov: Failed to properly create commit: ${err.message}`,
-                      Failed to properly create report: ${err.message}`,
                       failCi,
                   );
                 });
-          };
+          });
-          await exec.exec(
+    });
-              getCommand(
+  } catch (err) {
-                  filename,
+    setFailure(`Codecov: Encountered an unexpected error ${err.message}`, failCi);
-                  args,
+  }
-                  commitCommand,
+};
-              ).join(' '),
+
-              commitExecArgs, commitOptions)
+run();
-              .then(async (exitCode) => {
-                if (exitCode == 0) {
-                  await createReport();
-                }
-                unlink();
-              }).catch((err) => {
-                setFailure(
-                    `Codecov: Failed to properly create commit: ${err.message}`,
-                    failCi,
-                );
-              });
-        });
-  });
-} catch (err) {
-  setFailure(`Codecov: Encountered an unexpected error ${err.message}`, failCi);
-}

src/validate.ts

@@ -1,7 +1,7 @@
-import * as crypto from 'crypto';
+import {execSync} from 'node:child_process';
-import * as fs from 'fs';
+import * as crypto from 'node:crypto';
-import * as gpg from 'gpg';
+import * as fs from 'node:fs';
-import * as path from 'path';
+import * as path from 'node:path';
 
 import * as core from '@actions/core';
 import {request} from 'undici';
@@ -76,36 +76,43 @@ const verify = async (
       }
     };
 
-    const verifySignature = () => {
+    const verifySignature = async () => {
-      gpg.call('', [
+      const command = [
+        'gpg',
         '--logger-fd',
         '1',
         '--verify',
         path.join(__dirname, `${uploaderName}.SHA256SUM.sig`),
         path.join(__dirname, `${uploaderName}.SHA256SUM`),
-      ], async (err, verifyResult) => {
+      ].join(' ');
-        if (err) {
+
-          setFailure('Codecov: Error importing pgp key', failCi);
+      try {
-        }
+        await execSync(command, {stdio: 'inherit'});
-        core.info(verifyResult);
+      } catch (err) {
-        await validateSha();
+        setFailure(`Codecov: Error verifying gpg signature: ${err.message}`, failCi);
-      });
+      }
     };
 
-    // Import gpg key
+    const importKey = async () => {
-    gpg.call('', [
+      const command = [
-      '--logger-fd',
+        'gpg',
-      '1',
+        '--logger-fd',
-      '--no-default-keyring',
+        '1',
-      '--import',
+        '--no-default-keyring',
-      path.join(__dirname, 'pgp_keys.asc'),
+        '--import',
-    ], async (err, importResult) => {
+        path.join(__dirname, 'pgp_keys.asc'),
-      if (err) {
+      ].join(' ');
-        setFailure('Codecov: Error importing pgp key', failCi);
+
+      try {
+        await execSync(command, {stdio: 'inherit'});
+      } catch (err) {
+        setFailure(`Codecov: Error importing gpg key: ${err.message}`, failCi);
       }
-      core.info(importResult);
+    };
-      verifySignature();
+
-    });
+    await importKey();
+    await verifySignature();
+    await validateSha();
   } catch (err) {
     setFailure(`Codecov: Error validating uploader: ${err.message}`, failCi);
   }

src/version.ts

@@ -3,14 +3,12 @@ import {request} from 'undici';
 
 const versionInfo = async (
     platform: string,
-    version?: string,
+    version: string,
 ): Promise<void> => {
-  if (version) {
+  core.info(`==> Running version ${version}`);
-    core.info(`==> Running version ${version}`);
-  }
 
   try {
-    const metadataRes = await request(`https://cli.codecov.io/${platform}/latest`, {
+    const metadataRes = await request(`https://cli.codecov.io/${platform}/${version}`, {
       headers: {'Accept': 'application/json'},
     });
     const metadata = await metadataRes.body.json();