[I] [Bug] Legacy Codecov uploads are silently dropped by tokenless rate limits [hugegraph]

["contrueCT (via GitHub)" <gi...@apache.org>]

contrueCT opened a new issue, #3168:
URL: https://github.com/apache/hugegraph/issues/3168

   ### Bug Type
   
   CI / Test Coverage
   
   ### Environment
   
   Current `master` and pull requests from forks.
   
   ### Expected behavior
   
   Every workflow that produces coverage should upload its report reliably to the same Codecov commit. A missing upload should not make the commit appear to have lost coverage from modules whose tests completed successfully.
   
   ### Actual behavior
   
   The repository still uses `codecov/codecov-action@v3` in Commons, PD/Store/HStore, and Server CI. Pull requests from forks cannot access `CODECOV_TOKEN`, so these jobs use the legacy anonymous uploader.
   
   The legacy uploader shares a global tokenless rate limit. When that limit is exceeded, Codecov returns HTTP 429, but the uploader exits with status 0 by default. GitHub Actions therefore shows the producing job as green even though the report never reached Codecov.
   
   PR #3167 demonstrated the failure at commit `74e8701`: only one of the expected upload sessions was accepted, causing an apparent 4.92 percentage-point project coverage drop. PR #3161 reproduced the same behavior at commit `a63e48e9`: PD and HStore uploads returned 429 while other uploads happened to succeed, leaving `codecov/project` with an incomplete report set.
   
   ### Evidence
   
   - PR #3167 analysis: https://github.com/apache/hugegraph/pull/3167#issuecomment-5392946433
   - PR #3161 PD/Store/HStore run: https://github.com/apache/hugegraph/actions/runs/32705078797
   - Codecov documents that tokenless uploads from legacy uploaders share a global rate limit and recommends upgrading the CI action: https://docs.codecov.com/docs/codecov-tokens#legacy-upload-methods
   
   ### Proposed solution
   
   1. Upgrade every repository coverage upload from `codecov/codecov-action@v3` to `@v5` or newer.
   2. Replace the deprecated `file` input with `files`.
   3. Pass the existing `CODECOV_TOKEN` to trusted push/non-fork runs; fork pull requests will use the modern action's fork-aware tokenless flow because repository secrets are intentionally unavailable there.
   4. Add a lightweight configuration contract test covering all Codecov upload steps so workflows cannot drift back to the legacy uploader or omit the trusted-run token input.
   5. Keep the current non-blocking uploader policy in this change. Whether an external Codecov outage should fail otherwise healthy test jobs is a separate gate-policy decision.
   
   ### Scope
   
   This issue covers repository-wide Codecov uploader modernization and authentication routing only. It does not change JaCoCo collection, coverage thresholds, flags/carry-forward behavior, or production code. The PD/Store JaCoCo aggregation work remains tracked independently by #3160 and #3161.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@hugegraph.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Bug] Legacy Codecov uploads are silently dropped by tokenless rate limits [hugegraph]

["imbajin (via GitHub)" <gi...@apache.org>]

imbajin closed issue #3168: [Bug] Legacy Codecov uploads are silently dropped by tokenless rate limits
URL: https://github.com/apache/hugegraph/issues/3168


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@hugegraph.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org