chore(ci): bump codecov-action from v2 to v5 by ruflin · Pull Request #2307 · ruflin/Elastica

ruflin · 2026-04-30T20:40:14Z

Summary

codecov/codecov-action@v2 is several majors behind the current v5.5.x
line. Bump to v5 and align with the new input contract:

Pass token from the CODECOV_TOKEN secret (still works for the
tokenless fallback if no secret is configured).
Set fail_ci_if_error: false so a flaky upload does not block the
build.
Conditionally enable use_oidc to work around the
v5.4.1 regression
that breaks OIDC token requests on fork pull requests.

Identified during a P0/P1 code-review pass.

Test plan

Run the workflow once on this PR; confirm coverage upload succeeds.
Validate YAML.

Summary by CodeRabbit

Chores
- Updated the continuous integration workflow’s Codecov upload step to the latest action version, with improved coverage upload handling and more secure token-based integration.
- Adjusted the workflow behavior so OIDC is only used when appropriate, and CI won’t fail solely due to coverage upload errors.
- Reflected the CI change in the Unreleased changelog entry.

coderabbitai · 2026-04-30T20:40:27Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d6cd5831-b701-44f9-b59b-7c965e63fb0b

📥 Commits

Reviewing files that changed from the base of the PR and between 885f12e and 459c986.

📒 Files selected for processing (2)

.github/workflows/continuous-integration.yaml
CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (2)

CHANGELOG.md
.github/workflows/continuous-integration.yaml

📝 Walkthrough

Walkthrough

The CI workflow upgrades the Codecov GitHub Action from v2 to v5, configures coverage files, token handling, failure tolerance, and conditional OIDC support, and documents these changes in the changelog.

Changes

Codecov CI integration

Layer / File(s)	Summary
Configure and document Codecov upload `.github/workflows/continuous-integration.yaml`, `CHANGELOG.md`	The workflow adds OIDC permissions, upgrades Codecov to v5, configures coverage XML inputs and the token, tolerates upload failures, conditionally enables OIDC, and records the updated contract in the changelog.

Estimated code review effort: 2 (Simple) | ~8 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely summarizes the main change: upgrading codecov-action from v2 to v5.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/bump-codecov-action

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Pull request overview

Updates the CI workflow to use the current Codecov GitHub Action major version and adapts configuration to the v5 input contract to keep coverage uploads working reliably.

Changes:

Bumped codecov/codecov-action from v2 to v5 in the CI workflow.
Added v5-specific inputs (token, fail_ci_if_error: false) and a conditional use_oidc setting to avoid fork PR OIDC issues.
Documented the change in CHANGELOG.md.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`CHANGELOG.md`	Notes the Codecov action bump and related input changes under Unreleased.
`.github/workflows/continuous-integration.yaml`	Switches to `codecov/codecov-action@v5` and updates inputs, including conditional OIDC behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-30T20:42:06Z


      - name: 'Upload coverage to Codecov'
-        uses: codecov/codecov-action@v2
+        uses: codecov/codecov-action@v5


uses: entries in this workflow are consistently quoted (e.g., 'actions/checkout@v4', 'shivammathur/setup-php@v2'). For consistency (and to avoid YAML edge cases with @), quote codecov/codecov-action@v5 as well.

Suggested change

uses: codecov/codecov-action@v5

uses: 'codecov/codecov-action@v5'

Copilot · 2026-04-30T20:42:07Z

 * Added support for "search after" based pagination [#1645](https://github.com/ruflin/Elastica/issues/1645)
 * Added support for the `seq_no_primary_term` search option and the `if_seq_no` / `if_primary_term` index options to enable optimistic concurrency control [#2284](https://github.com/ruflin/Elastica/pull/2284)
 ### Changed
+* Bumped `codecov/codecov-action` from `v2` to `v5` and aligned it with the v5 input contract (`token`, `fail_ci_if_error: false`, conditional `use_oidc`).


This changelog’s bullet entries in the surrounding section don’t end with periods; this new entry does. Consider removing the trailing period for consistency.

Suggested change

* Bumped `codecov/codecov-action` from `v2` to `v5` and aligned it with the v5 input contract (`token`, `fail_ci_if_error: false`, conditional `use_oidc`).

* Bumped `codecov/codecov-action` from `v2` to `v5` and aligned it with the v5 input contract (`token`, `fail_ci_if_error: false`, conditional `use_oidc`)

`codecov/codecov-action@v2` is several majors behind the current v5.5.x line. Bump to v5 and align with the new input contract: - Pass `token` from the `CODECOV_TOKEN` secret. - Set `fail_ci_if_error: false` so a flaky upload does not block the build. - Conditionally enable `use_oidc` to work around the v5.4.1 regression that breaks OIDC token requests on fork pull requests.

The conditional use_oidc input made the action request an OIDC token, but id-token is never part of the default GITHUB_TOKEN scope, so the exchange failed with 'Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable' and took the whole PHPUnit job down with it (fail_ci_if_error does not cover an unhandled error inside the action). Request id-token: write explicitly, plus contents: read since naming a job-level permissions block drops the rest.

Copilot AI review requested due to automatic review settings April 30, 2026 20:40

Copilot started reviewing on behalf of ruflin April 30, 2026 20:40 View session

Copilot AI reviewed Apr 30, 2026

View reviewed changes

ruflin mentioned this pull request Apr 30, 2026

chore(ci): pin third-party GitHub Actions to full commit SHAs #2309

Open

2 tasks

ruflin added 2 commits July 28, 2026 22:59

ruflin force-pushed the chore/bump-codecov-action branch from 885f12e to 459c986 Compare July 28, 2026 21:00

Navigation Menu

chore(ci): bump codecov-action from v2 to v5 - #2307

chore(ci): bump codecov-action from v2 to v5#2307
ruflin wants to merge 2 commits into
9.xfrom
chore/bump-codecov-action

ruflin commented Apr 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 30, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

Copilot AI Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: codecov/codecov-action@v5
	uses: 'codecov/codecov-action@v5'

	* Bumped `codecov/codecov-action` from `v2` to `v5` and aligned it with the v5 input contract (`token`, `fail_ci_if_error: false`, conditional `use_oidc`).
	* Bumped `codecov/codecov-action` from `v2` to `v5` and aligned it with the v5 input contract (`token`, `fail_ci_if_error: false`, conditional `use_oidc`)

Conversation

ruflin commented Apr 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ruflin commented Apr 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 30, 2026 •

edited

Loading