chore(release): 5.5.5

Co-authored-by: Cursor <cursoragent@cursor.com>
fix: fetch Codecov PGP key from keybase.io/codecovsecops
2026-06-29 10:27:04 +00:00 · 2026-06-08 18:18:38 -06:00 · 2026-06-08 18:18:37 -06:00 · 2026-03-26 22:45:27 +09:00 · 2026-03-26 22:45:05 +09:00
4 changed files with 11 additions and 3 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,11 @@
 ## v5.5.5
 ### What's Changed
 * fix: fetch Codecov PGP key from keybase.io/codecovsecops
 **Full Changelog**: https://github.com/codecov/codecov-action/compare/v5.5.4..v5.5.5
 ## v5.5.2
 ### What's Changed
--- a/action.yml
+++ b/action.yml
@@ -230,7 +230,7 @@ runs:
        GITHUB_REPOSITORY: ${{ github.repository }}
    - name: Get OIDC token
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      id: oidc
      with:
        script: |
--- a/dist/codecov.sh
+++ b/dist/codecov.sh
@@ -110,7 +110,7 @@ then
    chmod +x "$CC_COMMAND"
  fi
 else
-  echo "$(curl -s https://keybase.io/codecovsecurity/pgp_keys.asc)" | \
+  echo "$(curl -s https://keybase.io/codecovsecops/pgp_keys.asc)" | \
    gpg --no-default-keyring --import
  # One-time step
  say "$g==>$x Verifying GPG signature integrity"
--- a/src/version
+++ b/src/version
@@ -1 +1 @@
-5.5.3
+5.5.5
Author	SHA1	Message	Date
Tom Hu	0fb7174895	chore(release): 5.5.5 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-08 18:18:38 -06:00
Tom Hu	f00ac4b766	fix: fetch Codecov PGP key from keybase.io/codecovsecops The Codecov security PGP key moved from keybase.io/codecovsecurity to keybase.io/codecovsecops. Update the bundled uploader script so GPG signature validation imports the key from the correct location. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-08 18:18:37 -06:00
Tom Hu	75cd11691c	chore(release): 5.5.4 (#1927 ) Co-authored-by: Tom Hu <tomhu1096@gmail.com>	2026-03-26 22:45:27 +09:00
Tom Hu	87d39f4a2c	Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0" (#1926 ) Revert "build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#1874)" This reverts commit `c143300dea`.	2026-03-26 22:45:05 +09:00