Merge pull request #287 from codecov/update-validation-regex

Update validation regex, pull checksums into script, and bump to 1.4.1

.eslintrc.json

@@ -0,0 +1,19 @@
+{
+    "env": {
+        "browser": true,
+        "commonjs": true,
+        "es2021": true
+    },
+    "extends": [
+        "google"
+    ],
+    "parser": "@typescript-eslint/parser",
+    "parserOptions": {
+        "ecmaVersion": 12
+    },
+    "plugins": [
+        "@typescript-eslint"
+    ],
+    "rules": {
+    }
+}

.github/workflows/main.yml

@@ -5,23 +5,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@master
+        uses: actions/checkout@v2
       - name: Install dependencies
         run: npm install
+      - name: Lint
+        run: npm run lint
       - name: Run tests and collect coverage
-        run: yarn run test-all
-      - name: Upload coverage to Codecov
+        run: yarn run test
+      - name: Upload coverage to Codecov (demo)
         uses: ./
         with:
-          files: ./coverage/calculator/coverage-final.json,./coverage/index/coverage-final.json
+          files: ./coverage/calculator/coverage-final.json,./coverage/coverage-test/coverage-final.json
           file: ./coverage/coverage-final.json
-          flags: unittest
-          name: codecov-1
-      - name: Upload coverage to Codecov (verbose)
+          flags: demo
+          name: codecov-demo
+      - name: Upload coverage to Codecov (script)
         uses: ./
         with:
-          files: ./coverage/calculator/coverage-final.json,./coverage/index/coverage-final.json
-          file: ./coverage/coverage-final.json
-          flags: unittest
-          name: codecov-1
-          verbose: true
+          files: ./coverage/script/coverage-final.json
+          flags: script
+          name: codecov-script

CHANGELOG.md

@@ -1,19 +1,53 @@
-### 1.1.1
+## 1.4.1
+## Fixes
+- #287 Update VERSION regex to restrict on digits and dot and move checksums into script
 
-#### Fixes
+## 1.4.0
+### Features
+- #282 Add checksum verification of bash script
+
+## 1.3.2
+### Fixes
+- #264 Overwrites pr number for pull_request_target events
+
+## 1.3.1
+### Fixes
+- #253 Add `network_filter` to action manifest
+
+## 1.3.0
+### Features
+- #252 Add "network_filter" input
+
+## 1.2.2
+### Fixes
+- #241 pass root_dir using proper bash arg
+- #244 Overwrite the commit on pull_request* events
+
+## 1.2.1
+### Fixes
+- #196 Add parameters to the action.yml
+
+## 1.2.0
+### Features
+- #193 Add all the bash params
+
+### Fixes
+- #193 Fixes issue with working-directory
+
+## 1.1.1
+### Fixes
 - #184 Add automations ensure proper builds and deployments
 - #184 Fixes verbose flag
 
-### 1.1.0
-
-#### Features
+## 1.1.0
+### Features
 - #110 Add "working-directory:" input
 - #174 Support Xcode specificed parameters
 
-#### Fixes
+### Fixes
 - #172 File is saved as text
 
-#### Dependencies and Misc
+### Dependencies and Misc
 - #166 Bump requestretry from 4.1.1 to 4.1.2
 - #169 Bump typescript from 4.0.5 to 4.1.2
 - #178 Bump @types/jest from 26.0.15 to 26.0.19

README.md

@@ -20,7 +20,6 @@ steps:
 - uses: codecov/codecov-action@v1
   with:
     token: ${{ secrets.CODECOV_TOKEN }} # not required for public repos
-    file: ./coverage.xml # optional
     files: ./coverage1.xml,./coverage2.xml # optional
     flags: unittests # optional
     name: codecov-umbrella # optional
@@ -36,14 +35,40 @@ Codecov's Action currently supports five inputs from the user: `token`, `file`,
 | Input  | Description | Usage |
 | :---:     |     :---:   |    :---:   |
 | `token`  | Used to authorize coverage report uploads  | *Required for private repos* |
-| `file`  | Path to the coverage report(s) | Optional
 | `files`  | Comma-separated paths to the coverage report(s) | Optional
 | `directory` | Directory to search for coverage reports. | Optional
 | `flags`  | Flag the upload to group coverage metrics (unittests, uitests, etc.). Multiple flags are separated by a comma (ui,chrome) | Optional
+| | |
+| `aws_curl_args` | Extra curl arguments to communicate with AWS. | Optional
+| `codecov_curl_args` | Extra curl arguments to communicate with Codecov. e.g., -U "--proxy http://http-proxy" | Optional
+| `commit_parent` | The commit SHA of the parent for which you are uploading coverage. If not present, the parent will be determined using the API of your repository provider.  When using the repository provider's API, the parent is determined via finding the closest ancestor to the commit. | Optional
 | `env_vars`  | Environment variables to tag the upload with. Multiple env variables can be separated with commas (e.g. `OS,PYTHON`) | Optional
-| `name`  | Custom defined name for the upload | Optional
 | `fail_ci_if_error`  | Specify if CI pipeline should fail when Codecov runs into errors during upload. *Defaults to **false*** | Optional
+| `functionalities` | Toggle functionalities | Optional
+| | `coveragepy` Disable python coverage |
+| | `fix` Disable report fixing |
+| | `gcov` Disable gcov |
+| | `gcovout` Disable gcov output |
+| | `html` Enable coverage for HTML files |
+| | `network` Disable uploading the file network |
+| | `recursesubs` Enable recurse submodules in git projects when searching for source files | |
+| | `search` Disable searching for reports |
+| | `xcode` Disable xcode processing |
+| `gcov_path_include` | Paths to include during gcov gathering (as a glob) | Optional
+| `gcov_args` | extra arguments to pass to gcov | Optional
+| `gcov_executable` | gcov executable to run. Defaults to 'gcov' | Optional
+| `gcov_path_exclude` | Paths to ignore during gcov gathering (as a glob) | Optional
+| `gcov_prefix` | Prefix filepaths to help resolve path fixing | Optional
+| `gcov_root_dir` | Project root directory, also used when preparing gcov | Optional
+| `move_coverage_to_trash` | Move discovered coverage reports to the trash | Optional
+| `name`  | Custom defined name for the upload | Optional
+| `override_branch` | Specify the branch name | Optional
+| `override_build` | Specify the build number | Optional
+| `override_commit` | Specify the commit SHA | Optional
+| `override_pr` | Specify the pull request number | Optional
+| `override_tag` | Specify the git tag | Optional
 | `path_to_write_report` | Write upload file to path before uploading | Optional
+| `root_dir` | Used when not in git/hg project to identify project root directory | Optional
 | `verbose` | Specify whether the Codecov output should be verbose | Optional
 | `working-directory` | Directory in which to execute `codecov.sh` | Optional
 | `xcode_derived_data` | Custom Derived Data Path for Coverage.profdata and gcov processing | Optional
@@ -78,7 +103,6 @@ jobs:
       uses: codecov/codecov-action@v1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
-        file: ./coverage.xml
         files: ./coverage1.xml,./coverage2.xml
         directory: ./coverage/reports/
         flags: unittests

action.yml

@@ -2,15 +2,9 @@ name: 'Codecov'
 description: 'GitHub Action that uploads coverage reports for your repository to codecov.io'
 author: 'Ibrahim Ali <@ibrahim0814> & Thomas Hu <@thomasrockhu> | Codecov'
 inputs:
-  name:
-    description: 'User defined upload name. Visible in Codecov UI'
-    required: false
   token:
     description: 'Repository upload token - get it from codecov.io. Required only for private repositories'
     required: false
-  file:
-    description: 'Path to coverage file to upload'
-    required: false
   files:
     description: 'Comma-separated list of files to upload'
     required: false
@@ -20,8 +14,14 @@ inputs:
   flags:
     description: 'Flag upload to group coverage metrics (e.g. unittests | integration | ui,chrome)'
     required: false
-  path_to_write_report:
-    description: 'Write upload file to path before uploading'
+  aws_curl_args:
+    description: 'Extra curl arguments to communicate with AWS.'
+    required: false
+  codecov_curl_args:
+    description: 'Extra curl arguments to communicate with Codecov. e.g., -U "--proxy http://http-proxy"'
+    required: false
+  commit_parent:
+    description: 'The commit SHA of the parent for which you are uploading coverage. If not present, the parent will be determined using the API of your repository provider.  When using the repository providers API, the parent is determined via finding the closest ancestor to the commit.'
     required: false
   env_vars:
     description: 'Environment variables to tag the upload with (e.g. PYTHON | OS,PYTHON)'
@@ -29,12 +29,72 @@ inputs:
   fail_ci_if_error:
     description: 'Specify whether or not CI build should fail if Codecov runs into an error during upload'
     required: false
+  file:
+    description: 'Path to coverage file to upload'
+    required: false
+  functionalities:
+    description: 'Comma-separated list, see the README for options and their usage'
+    required: false
+  gcov_args:
+    description: 'extra arguments to pass to gcov'
+    required: false
+  gcov_executable:
+    description: 'gcov executable to run. Defaults to gcov'
+    required: false
+  gcov_path_exclude:
+    description: 'Paths to ignore during gcov gathering (as a glob)'
+    required: false
+  gcov_path_include:
+    description: 'Paths to include during gcov gathering (as a glob)'
+    required: false
+  gcov_prefix:
+    description: 'Prefix filepaths to help resolve path fixing'
+    required: false
+  gcov_root_dir:
+    description: 'Project root directory, also used when preparing gcov'
+    required: false
+  move_coverage_to_trash:
+    description: 'Move discovered coverage reports to the trash'
+    required: false
+  name:
+    description: 'User defined upload name. Visible in Codecov UI'
+    required: false
+  network_filter:
+    description: 'Used to restrict the set of git/hg files that can be matched with filenames in the coverage report. This is useful for monorepos or other setups where a full filepath may not be specified in the coverage report, and that shortened filepath may appear multiple times in a directory structure (e.g. __init__.py)'
+    required: false
+  override_branch:
+    description: 'Specify the branch name'
+    required: false
+  override_build:
+    description: 'Specify the build number'
+    required: false
+  override_commit:
+    description: 'Specify the commit SHA'
+    required: false
+  override_pr:
+    description: 'Specify the pull request number'
+    required: false
+  override_tag:
+    description: 'Specify the git tag'
+    required: false
+  path_to_write_report:
+    description: 'Write upload file to path before uploading'
+    required: false
+  root_dir:
+    description: 'Used when not in git/hg project to identify project root directory'
+    required: false
   verbose:
     description: 'Specify whether the Codecov output should be verbose'
     required: false
   working-directory:
     description: 'Directory in which to execute codecov.sh'
     required: false
+  xcode_derived_data:
+    description: 'Custom Derived Data Path for Coverage.profdata and gcov processing'
+    required: false
+  xcode_package:
+    description: 'Specify packages to build coverage. Uploader will only build these packages'
+    required: false
 branding:
   color: 'red'
   icon: 'umbrella'

demo/coverage-test/coverage.test.ts

@@ -0,0 +1,11 @@
+import Coverage from "./coverage";
+
+test('test uncovered if', () => {
+  const coverageObj = new Coverage();
+  expect(coverageObj.uncovered_if()).toEqual(false);
+});
+
+test('fully covered', () => {
+  const coverageObj = new Coverage();
+  expect(coverageObj.fully_covered()).toEqual(true);
+});

demo/coverage-test/coverage.ts

@@ -1,4 +1,4 @@
-export default class Index {
+export default class Coverage {
 
   //This function is tested and part of it is uncovered
   uncovered_if = (a = true) => {

hooks/pre-commit

@@ -1,5 +1,8 @@
 #!/usr/bin/env bash
 
 npm i --package-lock-only
+npm run lint --fix
 npm run build
+git add src/
 git add dist/index.js
+git add package-lock.json

index.js

@@ -1,206 +0,0 @@
-const core = require("@actions/core");
-const exec = require("@actions/exec");
-const fs = require("fs");
-const request = require('requestretry');
-
-let fail_ci;
-let verbose;
-try {
-  const name = core.getInput("name");
-  const token = core.getInput("token");
-  const flags = core.getInput("flags");
-  const file = core.getInput("file");
-  const files = core.getInput("files");
-  const env_vars = core.getInput("env_vars");
-  const dir = core.getInput("directory");
-  const write_path = core.getInput("path_to_write_report");
-  const working_dir = core.getInput("working-directory");
-  const xcode_derived_data = core.getInput("xcode_derived_data");
-  const xcode_package = core.getInput("xcode_package");
-
-  fail_ci = core.getInput("fail_ci_if_error").toLowerCase();
-  verbose = core.getInput("verbose").toLowerCase();
-
-  if (
-    fail_ci === "yes" ||
-    fail_ci === "y" ||
-    fail_ci === "true" ||
-    fail_ci === "t" ||
-    fail_ci === "1"
-  ) {
-    fail_ci = true;
-  } else {
-    fail_ci = false;
-  }
-
-  if (
-    verbose === "yes" ||
-    verbose === "y" ||
-    verbose === "true" ||
-    verbose === "t" ||
-    verbose === "1"
-  ) {
-    verbose = true;
-  } else {
-    verbose = false;
-  }
-
-  request({
-    json: false,
-    maxAttempts: 10,
-    timeout: 3000,
-    url: "https://codecov.io/bash"
-  }, (error, response, body) => {
-    try {
-      if (error && fail_ci) {
-        throw error;
-      } else if (error) {
-        core.warning(`Codecov warning: ${error.message}`);
-      }
-
-      fs.writeFile("codecov.sh", body, err => {
-        if (err && fail_ci) {
-          throw err;
-        } else if (err) {
-          core.warning(`Codecov warning: ${err.message}`);
-        }
-
-        let output = "";
-        let execError = "";
-        const options = {};
-        options.listeners = {
-          stdout: data => {
-            output += data.toString();
-          },
-          stderr: data => {
-            execError += data.toString();
-          }
-        };
-
-        options.env = Object.assign(process.env, {
-          GITHUB_ACTION: process.env.GITHUB_ACTION,
-          GITHUB_RUN_ID: process.env.GITHUB_RUN_ID,
-          GITHUB_REF: process.env.GITHUB_REF,
-          GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY,
-          GITHUB_SHA: process.env.GITHUB_SHA,
-          GITHUB_HEAD_REF: process.env.GITHUB_HEAD_REF || ''
-        });
-
-        if(token){
-          options.env.CODECOV_TOKEN = token
-        }
-
-        const env_vars_arg = []
-        for (let env_var of env_vars.split(",")) {
-          let env_var_clean = env_var.trim();
-          if (env_var_clean) {
-            options.env[env_var_clean] = process.env[env_var_clean];
-            env_vars_arg.push(env_var_clean)
-          }
-        }
-
-        const execArgs = ["codecov.sh"];
-        execArgs.push("-Q", "github-action");
-
-        if (file) {
-          execArgs.push(
-            "-f", `${file}`
-          );
-        }
-
-        if (files) {
-          files.split(',').forEach(f => {
-            execArgs.push(
-              "-f", `${f}`
-            );
-          });
-        }
-
-        if (dir) {
-          execArgs.push(
-            "-s", `${dir}`
-          );
-        }
-
-        execArgs.push(
-          "-n", `${name}`,
-          "-F", `${flags}`
-        );
-
-        if (fail_ci) {
-          execArgs.push(
-            "-Z"
-          );
-        }
-
-        if (env_vars_arg.length) {
-          execArgs.push(
-            "-e", env_vars_arg.join(",")
-          );
-        }
-
-        if (write_path) {
-          execArgs.push(
-            "-q", `${write_path}`
-          );
-        }
-
-        if (verbose) {
-          execArgs.push(
-            "-v"
-          );
-        }
-
-        if (working_dir) {
-          options.cwd = working_dir;
-        }
-
-        if (xcode_derived_data) {
-          execArgs.push(
-            "-D", `${xcode_derived_data}`
-          );
-        }
-
-        if (xcode_package) {
-          execArgs.push(
-            "-J", `${xcode_package}`
-          );
-        }
-
-        exec.exec("bash", execArgs, options)
-          .catch(err => {
-            if (fail_ci) {
-              core.setFailed(
-                `Codecov failed with the following error: ${err.message}`
-              );
-            } else {
-              core.warning(`Codecov warning: ${err.message}`);
-            }
-          })
-          .then(() => {
-            unlinkFile();
-          });
-
-        const unlinkFile = () => {
-          fs.unlink("codecov.sh", err => {
-            if (err && fail_ci) {
-              throw err;
-            } else if (err) {
-              core.warning(`Codecov warning: ${err.message}`);
-            }
-          });
-        };
-      });
-    } catch (error) {
-      core.setFailed(
-        `Codecov failed with the following error: ${error.message}`
-      );
-    }
-  });
-} catch (error) {
-  if (fail_ci) {
-    core.setFailed(`Codecov failed with the following error: ${error.message}`);
-  } else {
-    core.warning(`Codecov warning: ${error.message}`);
-  }
-}

package.json

@@ -1,14 +1,15 @@
 {
   "name": "codecov-action",
-  "version": "1.1.1",
+  "version": "1.4.1",
   "description": "Upload coverage reports to Codecov from GitHub Actions",
   "main": "index.js",
   "scripts": {
-    "test": "jest --coverage",
-    "test-calculator": "jest --testPathPattern=src/calculator/ --coverage --coverageDirectory=coverage/calculator",
-    "test-index": "jest --testPathPattern=src/index --coverage --coverageDirectory=coverage/index",
-    "test-all": "yarn run test && yarn run test-calculator && yarn run test-index",
-    "build": "ncc build index.js"
+    "lint": "eslint src/*.*",
+    "test": "yarn run test-script && yarn run test-calculator && yarn run test-coverage",
+    "test-calculator": "jest --testPathPattern=demo/calculator/ --coverage --coverageDirectory=coverage/calculator",
+    "test-coverage": "jest --testPathPattern=demo/coverage-test/ --coverage --coverageDirectory=coverage/coverage-test",
+    "test-script": "jest --testPathPattern=src/ --coverage --coverageDirectory=coverage/script",
+    "build": "ncc build src/index.ts"
   },
   "repository": {
     "type": "git",
@@ -24,16 +25,22 @@
   "dependencies": {
     "@actions/core": "^1.2.6",
     "@actions/exec": "^1.0.4",
-    "@types/jest": "^26.0.19",
+    "@actions/github": "^4.0.0",
+    "@types/jest": "^26.0.20",
     "@zeit/ncc": "^0.22.3",
     "fs": "0.0.1-security",
     "jest": "^26.6.3",
     "jest-junit": "^12.0.0",
     "request": "^2.88.2",
-    "requestretry": "^4.1.2",
-    "ts-jest": "^26.4.4",
-    "typescript": "^4.1.3",
+    "requestretry": "^5.0.0",
+    "ts-jest": "^26.5.3",
+    "typescript": "^4.2.3",
     "yarn": "^1.22.10"
   },
-  "devDependencies": {}
+  "devDependencies": {
+    "@typescript-eslint/eslint-plugin": "^4.16.1",
+    "@typescript-eslint/parser": "^4.20.0",
+    "eslint": "^7.21.0",
+    "eslint-config-google": "^0.14.0"
+  }
 }

src/buildExec.test.ts

@@ -0,0 +1,148 @@
+import buildExec from './buildExec';
+const github = require('@actions/github');
+const context = github.context;
+
+test('no arguments', () => {
+  const {execArgs, filepath, failCi} = buildExec();
+
+  const args = [
+    'codecov.sh',
+    '-n',
+    '',
+    '-F',
+    '',
+    '-Q',
+    'github-action',
+  ];
+  if (context.eventName == 'pull_request') {
+    args.push('-C', `${context.payload.pull_request.head.sha}`);
+  }
+  expect(execArgs).toEqual(args);
+  expect(filepath).toEqual('codecov.sh');
+  expect(failCi).toBeFalsy();
+});
+
+test('all arguments', () => {
+  const envs = {
+    'move_coverage_to_trash': 'true',
+    'commit_parent': '83231650328f11695dfb754ca0f540516f188d27',
+    'aws_curl_args': '--timeout 1',
+    'codecov_curl_args': '--timeout 2',
+    'env_vars': 'OS,PYTHON',
+    'fail_ci_if_error': 'true',
+    'file': 'coverage.xml',
+    'files': 'dir1/coverage.xml,dir2/coverage.xml',
+    'flags': 'test',
+    'functionalities':
+      'gcov,coveragepy,fix,search,code,network,gcovout,html,recursesubs',
+    'gcov_args': '--timeout 3',
+    'gcov_root_dr': 'gcov_dir/',
+    'gcov_path_exclude': '**/exclude-dir/*.*',
+    'gcov_executable': 'gcov',
+    'gcov_path_include': '**/include-dir/*.*',
+    'gcov_prefix': 'demo',
+    'name': 'codecov',
+    'network_filter': 'dir1',
+    'override_branch': 'thomasrockhu/test',
+    'override_build': '1',
+    'override_commit': '9caabca5474b49de74ef5667deabaf74cdacc244',
+    'override_pr': '2',
+    'override_tag': 'v1.2',
+    'root_dir': 'root/',
+    'directory': 'coverage/',
+    'token': 'd3859757-ab80-4664-924d-aef22fa7557b',
+    'verbose': 't',
+    'working-directory': 'src',
+    'path_to_write_report': 'codecov/',
+    'xcode_derived_data': '~/Library/Developer/Xcode/DerivedData',
+    'xcode_package': 'MyApp',
+  };
+
+  for (const env of Object.keys(envs)) {
+    process.env['INPUT_' + env.toUpperCase()] = envs[env];
+  }
+
+  const {execArgs, filepath, failCi} = buildExec();
+  expect(execArgs).toEqual([
+    'src/codecov.sh',
+    '-n',
+    'codecov',
+    '-F',
+    'test',
+    '-Q',
+    'github-action',
+    '-c',
+    '-N',
+    '83231650328f11695dfb754ca0f540516f188d27',
+    '-A',
+    '--timeout 1',
+    '-U',
+    '--timeout 2',
+    '-e',
+    'OS,PYTHON',
+    '-Z',
+    '-f',
+    'coverage.xml',
+    '-f',
+    'dir1/coverage.xml',
+    '-f',
+    'dir2/coverage.xml',
+    '-X',
+    'gcov',
+    '-X',
+    'coveragepy',
+    '-X',
+    'fix',
+    '-X',
+    'search',
+    '-X',
+    'code',
+    '-X',
+    'network',
+    '-X',
+    'gcovout',
+    '-X',
+    'html',
+    '-X',
+    'recursesubs',
+    '-a',
+    '--timeout 3',
+    '-g',
+    '**/exclude-dir/*.*',
+    '-x',
+    'gcov',
+    '-G',
+    '**/include-dir/*.*',
+    '-k',
+    'demo',
+    '-i',
+    'dir1',
+    '-B',
+    'thomasrockhu/test',
+    '-b',
+    '1',
+    '-C',
+    '9caabca5474b49de74ef5667deabaf74cdacc244',
+    '-P',
+    '2',
+    '-T',
+    'v1.2',
+    '-R',
+    'root/',
+    '-s',
+    'coverage/',
+    '-v',
+    '-q',
+    'codecov/',
+    '-D',
+    '~/Library/Developer/Xcode/DerivedData',
+    '-J',
+    'MyApp',
+  ]);
+  expect(filepath).toEqual('src/codecov.sh');
+  expect(failCi).toBeTruthy();
+
+  for (const env of Object.keys(envs)) {
+    delete process.env['INPUT_' + env.toUpperCase()];
+  }
+});

src/buildExec.ts

@@ -0,0 +1,179 @@
+const core = require('@actions/core');
+const github = require('@actions/github');
+
+const context = github.context;
+
+const isTrue = (variable) => {
+  const lowercase = variable.toLowerCase();
+  return (
+    lowercase === '1' ||
+    lowercase === 't' ||
+    lowercase === 'true' ||
+    lowercase === 'y' ||
+    lowercase === 'yes'
+  );
+};
+
+const buildExec = () => {
+  const clean = core.getInput('move_coverage_to_trash');
+  const commitParent = core.getInput('commit_parent');
+  const curlAwsArgs = core.getInput('aws_curl_args');
+  const curlCodecovArgs = core.getInput('codecov_curl_args');
+  const envVars = core.getInput('env_vars');
+  const failCi = isTrue(core.getInput('fail_ci_if_error'));
+  const file = core.getInput('file');
+  const files = core.getInput('files');
+  const flags = core.getInput('flags');
+  const functionalities = core.getInput('functionalities');
+  const gcovArgs = core.getInput('gcov_args');
+  const gcovDir = core.getInput('gcov_root_dir');
+  const gcovExclude = core.getInput('gcov_path_exclude');
+  const gcovExec = core.getInput('gcov_executable');
+  const gcovInclude = core.getInput('gcov_path_include');
+  const gcovPrefix = core.getInput('gcov_prefix');
+  const name = core.getInput('name');
+  const networkFilter = core.getInput('network_filter');
+  const overrideBranch = core.getInput('override_branch');
+  const overrideBuild = core.getInput('override_build');
+  const overrideCommit = core.getInput('override_commit');
+  const overridePr = core.getInput('override_pr');
+  const overrideTag = core.getInput('override_tag');
+  const rootDir = core.getInput('root_dir');
+  const searchDir = core.getInput('directory');
+  const token = core.getInput('token');
+  const verbose = isTrue(core.getInput('verbose'));
+  const workingDir = core.getInput('working-directory');
+  const writePath = core.getInput('path_to_write_report');
+  const xcodeDerivedData = core.getInput('xcode_derived_data');
+  const xcodePackage = core.getInput('xcode_package');
+
+  const filepath = workingDir ?
+    workingDir + '/codecov.sh' : 'codecov.sh';
+
+  const execArgs = [filepath];
+  execArgs.push( '-n', `${name}`, '-F', `${flags}`, '-Q', 'github-action' );
+
+  const options:any = {};
+  options.env = Object.assign(process.env, {
+    GITHUB_ACTION: process.env.GITHUB_ACTION,
+    GITHUB_RUN_ID: process.env.GITHUB_RUN_ID,
+    GITHUB_REF: process.env.GITHUB_REF,
+    GITHUB_REPOSITORY: process.env.GITHUB_REPOSITORY,
+    GITHUB_SHA: process.env.GITHUB_SHA,
+    GITHUB_HEAD_REF: process.env.GITHUB_HEAD_REF || '',
+  });
+
+  const envVarsArg = [];
+  for (const envVar of envVars.split(',')) {
+    const envVarClean = envVar.trim();
+    if (envVarClean) {
+      options.env[envVarClean] = process.env[envVarClean];
+      envVarsArg.push(envVarClean);
+    }
+  }
+
+  if (token) {
+    options.env.CODECOV_TOKEN = token;
+  }
+  if (clean) {
+    execArgs.push('-c');
+  }
+  if (commitParent) {
+    execArgs.push('-N', `${commitParent}`);
+  }
+  if (curlAwsArgs) {
+    execArgs.push('-A', `${curlAwsArgs}`);
+  }
+  if (curlCodecovArgs) {
+    execArgs.push('-U', `${curlCodecovArgs}`);
+  }
+  if (envVarsArg.length) {
+    execArgs.push('-e', envVarsArg.join(','));
+  }
+  if (failCi) {
+    execArgs.push('-Z');
+  }
+  if (file) {
+    execArgs.push('-f', `${file}`);
+  }
+  if (files) {
+    files.split(',').forEach((f) => {
+      execArgs.push('-f', `${f}`);
+    });
+  }
+  if (functionalities) {
+    functionalities.split(',').forEach((f) => {
+      execArgs.push('-X', `${f}`);
+    });
+  }
+  if (gcovArgs) {
+    execArgs.push('-a', `${gcovArgs}`);
+  }
+  if (gcovDir) {
+    execArgs.push('-p', `${gcovDir}`);
+  }
+  if (gcovExclude) {
+    execArgs.push('-g', `${gcovExclude}`);
+  }
+  if (gcovExec) {
+    execArgs.push('-x', `${gcovExec}`);
+  }
+  if (gcovInclude) {
+    execArgs.push('-G', `${gcovInclude}`);
+  }
+  if (gcovPrefix) {
+    execArgs.push('-k', `${gcovPrefix}`);
+  }
+  if (networkFilter) {
+    execArgs.push('-i', `${networkFilter}`);
+  }
+  if (overrideBranch) {
+    execArgs.push('-B', `${overrideBranch}`);
+  }
+  if (overrideBuild) {
+    execArgs.push('-b', `${overrideBuild}`);
+  }
+  if (overrideCommit) {
+    execArgs.push('-C', `${overrideCommit}`);
+  } else if (
+    `${context.eventName}` == 'pull_request' ||
+    `${context.eventName}` == 'pull_request_target'
+  ) {
+    execArgs.push('-C', `${context.payload.pull_request.head.sha}`);
+  }
+  if (overridePr) {
+    execArgs.push('-P', `${overridePr}`);
+  } else if (
+    `${context.eventName}` == 'pull_request_target'
+  ) {
+    execArgs.push('-P', `${context.payload.number}`);
+  }
+  if (overrideTag) {
+    execArgs.push('-T', `${overrideTag}`);
+  }
+  if (rootDir) {
+    execArgs.push('-R', `${rootDir}`);
+  }
+  if (searchDir) {
+    execArgs.push('-s', `${searchDir}`);
+  }
+  if (verbose) {
+    execArgs.push('-v');
+  }
+  if (workingDir) {
+    options.cwd = workingDir;
+  }
+  if (writePath) {
+    execArgs.push('-q', `${writePath}`);
+  }
+  if (xcodeDerivedData) {
+    execArgs.push('-D', `${xcodeDerivedData}`);
+  }
+  if (xcodePackage) {
+    execArgs.push('-J', `${xcodePackage}`);
+  }
+
+  return {execArgs, options, filepath, failCi};
+};
+
+export default buildExec;

src/index.ts

@@ -0,0 +1,79 @@
+const core = require('@actions/core');
+const exec = require('@actions/exec');
+
+const fs = require('fs');
+const request = require('requestretry');
+
+import buildExec from './buildExec';
+import validateUploader from './validate';
+
+let failCi;
+try {
+  request({
+    json: false,
+    maxAttempts: 10,
+    timeout: 3000,
+    url: 'https://codecov.io/bash',
+  }, async (error, response, body) => {
+    const {execArgs, options, filepath, failCi} = buildExec();
+
+    try {
+      const isValid = validateUploader(body);
+      if (!isValid) {
+        const failure = 'Codecov failure: ' +
+            'Bash script checksums do not match published values. ' +
+            'Please contact security@codecov.io immediately.';
+        core.setFailed(failure);
+        throw new Error(failure);
+      }
+
+      if (error && failCi) {
+        throw error;
+      } else if (error) {
+        core.warning(`Codecov warning: ${error.message}`);
+      }
+
+      fs.writeFile(filepath, body, (err) => {
+        if (err && failCi) {
+          throw err;
+        } else if (err) {
+          core.warning(`Codecov warning: ${err.message}`);
+        }
+
+        exec.exec('bash', execArgs, options)
+            .catch((err) => {
+              if (failCi) {
+                core.setFailed(
+                    `Codecov failed with the following error: ${err.message}`,
+                );
+              } else {
+                core.warning(`Codecov warning: ${err.message}`);
+              }
+            })
+            .then(() => {
+              unlinkFile();
+            });
+
+        const unlinkFile = () => {
+          fs.unlink(filepath, (err) => {
+            if (err && failCi) {
+              throw err;
+            } else if (err) {
+              core.warning(`Codecov warning: ${err.message}`);
+            }
+          });
+        };
+      });
+    } catch (error) {
+      core.setFailed(
+          `Codecov failed with the following error: ${error.message}`,
+      );
+    }
+  });
+} catch (error) {
+  if (failCi) {
+    core.setFailed(`Codecov failed with the following error: ${error.message}`);
+  } else {
+    core.warning(`Codecov warning: ${error.message}`);
+  }
+}

src/index/index.test.ts

@@ -1,11 +0,0 @@
-import Index from "./index";
-
-test('test uncovered if', () => {
-  const indexObj = new Index();
-  expect(indexObj.uncovered_if()).toEqual(false);
-});
-
-test('fully covered', () => {
-  const indexObj = new Index();
-  expect(indexObj.fully_covered()).toEqual(true);
-});

src/validate.test.ts

@@ -0,0 +1,50 @@
+import validateUploader, {retrieveChecksum} from './validate';
+
+const request = require('requestretry');
+
+const bashScript = (async () => {
+  try {
+    const script = await request({
+      json: false,
+      maxAttempts: 10,
+      timeout: 3000,
+      url: 'https://codecov.io/bash',
+    });
+    return script.body;
+  } catch (err) {
+    throw err;
+  }
+});
+
+test('valid checksums', async () => {
+  const valid = validateUploader(await bashScript());
+  expect(valid).toBeTruthy();
+});
+
+test('invalid checksums', async () => {
+  const script = await bashScript();
+  const valid = validateUploader(script.substring(0, script.length - 1));
+  expect(valid).toBeFalsy();
+});
+
+test('invalid script version', async () => {
+  const script = await bashScript();
+  const valid = validateUploader(script.substring(0, 20));
+  expect(valid).toBeFalsy();
+});
+
+test('invalid public checksum file', () => {
+  const checksum = retrieveChecksum('foo', 'bar');
+  expect(checksum).toBeFalsy();
+});
+
+test('invalid public checksum file', () => {
+  const checksum = retrieveChecksum('foo', 'bar');
+  expect(checksum).toBeFalsy();
+});
+
+test('invalid encryption', () => {
+  const checksum = retrieveChecksum('1.0.1', 'foo');
+  expect(checksum).toBeFalsy();
+});
+

src/validate.ts

@@ -0,0 +1,61 @@
+const crypto = require('crypto');
+
+const core = require('@actions/core');
+
+const validateUploader = (body) => {
+  const version = getVersion(body);
+  if (version === null) {
+    core.warning('Codecov could not identify the bash uploader version.');
+    return false;
+  }
+
+  for (const i of [1, 256, 512]) {
+    const publicChecksum = retrieveChecksum(version, i);
+    const uploaderChecksum = calculateChecksum(body, i);
+    if (uploaderChecksum !== publicChecksum) {
+      core.warning(
+          `Codecov ${version} checksums for SHA${i} failed to match.\n` +
+          `Public checksum:   ${publicChecksum}` +
+          `Uploader checksum: ${uploaderChecksum}`,
+      );
+      return false;
+    }
+  }
+  return true;
+};
+
+export const retrieveChecksum = (version, encryption) => {
+  const checksums = {
+    '1.0.1': {
+      '1': '0ddc61a9408418c73b19a1375f63bb460dc947a8',
+      '256': '89c658e261d5f25533598a222fd96cf17a5fa0eb3772f2defac754d9970b2ec8',
+      '512': 'd075b412a362a9a2b7aedfec3b8b9a9a927b3b99e98c7c15a2b76ef09862ae' +
+        'b005e91d76a5fd71b511141496d0fd23d1b42095f722ebcd509d768fba030f159e',
+    },
+    '1.0.2': {
+      '1': '537069158a6f72b145cfe5f782dceb608d9ef594',
+      '256': 'd6aa3207c4908d123bd8af62ec0538e3f2b9f257c3de62fad4e29cd3b59b41d9',
+      '512': 'b6492196dd844cd81a688536bb42463d28bd666448335c4a8fc7f8f9b9b9af' +
+        'c346a467e3401e3fc49e6047442a30d93a4adfaa1590101224a186013c6179c48d',
+    },
+  };
+
+  if (version in checksums && encryption in checksums[version]) {
+    return checksums[version][encryption];
+  }
+  return null;
+};
+
+const calculateChecksum = (body, i) => {
+  const shasum = crypto.createHash(`sha${i}`);
+  shasum.update(body);
+  return `${shasum.digest('hex')}`;
+};
+
+const getVersion = (body) => {
+  const regex = /VERSION="([\d\.]+)"/g;
+  const match = regex.exec(body);
+  return match ? match[1] : null;
+};
+
+export default validateUploader;

tsconfig.json

@@ -0,0 +1,5 @@
+{
+  "include": [
+    "src"
+  ]
+}