Add Codecov integration for ocp-secrets-management-console #80524
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -12,6 +12,8 @@ images: | |
| items: | ||
| - dockerfile_path: Dockerfile | ||
| to: ocp-secrets-management-console | ||
| - dockerfile_path: images/ci/Dockerfile.coverage | ||
| to: ocp-secrets-management-console-coverage | ||
| resources: | ||
| '*': | ||
| limits: | ||
|
|
@@ -25,6 +27,35 @@ tests: | |
| yarn install && LANG=en_US.UTF-8 yarn test | ||
| container: | ||
| from: src | ||
| - as: unit-with-coverage | ||
| postsubmit: true | ||
| steps: | ||
| post: | ||
| - as: collect-coverage | ||
| best_effort: true | ||
| cli: latest | ||
| commands: | | ||
| curl -Os https://uploader.codecov.io/latest/linux/codecov | ||
| chmod +x codecov | ||
| ./codecov upload-process --token=$(cat /var/run/secrets/codecov/token) | ||
|
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: The Codecov CLI upload-process command is a convenient wrapper that executes three distinct stages in a single operation: creating a commit, creating a report, and performing the actual upload [1][2][3]. Using this command simplifies your CI workflow by replacing the need to execute these steps individually [1][3]. CODECOV_TOKEN Usage The Codecov CLI automatically searches the environment for a variable named CODECOV_TOKEN [2][3][4]. If this environment variable is correctly configured in your CI provider's secrets, the CLI will use it automatically without requiring additional flags [2][4]. If you prefer not to use an environment variable, or if you need to override it, you can pass the token manually as a command-line argument using the -t or --token flag [5][6][7]: codecovcli upload-process -t Example usage in a CI environment:./codecov --verbose upload-process --disable-search -t ${{ secrets.CODECOV_TOKEN }} -n 'job-name'-${{ github.run_id }} -F -f [5][8] Key Considerations: - Token Security: Always use your CI provider's secret management system to store the CODECOV_TOKEN rather than hardcoding it in scripts [8][9]. - Flexibility: While upload-process is a wrapper, you can still customize the command with additional options (e.g., --disable-search, --flag, --file) to suit your project's specific requirements [5][6]. - Legacy Migration: If you are migrating from the older NodeJS Binary Uploader, replacing your existing upload step with the upload-process command is the recommended approach for the Codecov CLI [5][1][3]. Citations:
🏁 Script executed: # First, locate and read the file mentioned in the review
cat -n "ci-operator/config/openshift/ocp-secrets-management-console/openshift-ocp-secrets-management-console-main.yaml" | sed -n '35,45p'Repository: openshift/release Length of output: 543 🏁 Script executed: # Search for other Codecov invocations in the codebase to understand patterns
rg "codecov.*upload-process" --type yaml --type sh -A 2 -B 2Repository: openshift/release Length of output: 850 🏁 Script executed: # Check if this invocation is in a step-registry commands script or inline in config
grep -r "upload-process.*token" --include="*.sh" --include="*.yaml"Repository: openshift/release Length of output: 251 Use The - ./codecov upload-process --token=$(cat /var/run/secrets/codecov/token)
+ export CODECOV_TOKEN=$(cat /var/run/secrets/codecov/token)
+ ./codecov upload-processThis prevents the token from appearing in the command invocation itself. 🤖 Prompt for AI Agents |
||
| credentials: | ||
| - mount_path: /var/run/secrets/codecov | ||
| name: ocp-secrets-management-console-codecov-token | ||
| namespace: test-credentials | ||
| from: src | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| timeout: 15m0s | ||
| test: | ||
| - as: test | ||
| cli: latest | ||
| commands: | | ||
| yarn install && LANG=en_US.UTF-8 yarn coverage | ||
| from: src | ||
| resources: | ||
| requests: | ||
| cpu: 100m | ||
| - as: operator-unit | ||
| commands: | | ||
| unset GOFLAGS && cd operator && make test | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| postsubmits: | ||
| openshift/ocp-secrets-management-console: | ||
| - agent: kubernetes | ||
| always_run: true | ||
| branches: | ||
| - ^main$ | ||
| cluster: build01 | ||
| decorate: true | ||
| decoration_config: | ||
| sparse_checkout_files: | ||
| - Dockerfile | ||
| - images/ci/Dockerfile.coverage | ||
| labels: | ||
| ci.openshift.io/generator: prowgen | ||
| max_concurrency: 1 | ||
| name: branch-ci-openshift-ocp-secrets-management-console-main-unit-with-coverage | ||
| spec: | ||
| containers: | ||
| - args: | ||
| - --gcs-upload-secret=/secrets/gcs/service-account.json | ||
| - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson | ||
| - --lease-server-credentials-file=/etc/boskos/credentials | ||
| - --report-credentials-file=/etc/report/credentials | ||
| - --target=unit-with-coverage | ||
| command: | ||
| - ci-operator | ||
| env: | ||
| - name: HTTP_SERVER_IP | ||
| valueFrom: | ||
| fieldRef: | ||
| fieldPath: status.podIP | ||
| image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest | ||
| imagePullPolicy: Always | ||
| name: "" | ||
| ports: | ||
| - containerPort: 8080 | ||
| name: http | ||
| resources: | ||
| requests: | ||
| cpu: 10m | ||
| volumeMounts: | ||
| - mountPath: /etc/boskos | ||
| name: boskos | ||
| readOnly: true | ||
| - mountPath: /secrets/gcs | ||
| name: gcs-credentials | ||
| readOnly: true | ||
| - mountPath: /secrets/manifest-tool | ||
| name: manifest-tool-local-pusher | ||
| readOnly: true | ||
| - mountPath: /etc/pull-secret | ||
| name: pull-secret | ||
| readOnly: true | ||
| - mountPath: /etc/report | ||
| name: result-aggregator | ||
| readOnly: true | ||
| serviceAccountName: ci-operator | ||
| volumes: | ||
| - name: boskos | ||
| secret: | ||
| items: | ||
| - key: credentials | ||
| path: credentials | ||
| secretName: boskos-credentials | ||
| - name: manifest-tool-local-pusher | ||
| secret: | ||
| secretName: manifest-tool-local-pusher | ||
| - name: pull-secret | ||
| secret: | ||
| secretName: registry-pull-credentials | ||
| - name: result-aggregator | ||
| secret: | ||
| secretName: result-aggregator |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
How to verify Codecov uploader integrity with checksum or GPG signature?💡 Result:
To ensure the integrity of the Codecov CLI or uploader binary, it is highly recommended to perform both GPG signature and SHA256 checksum verification [1][2]. The verification process consists of two primary steps: verifying the digital signature of the checksum file using Codecov's PGP key, and then verifying the binary's checksum against that file [1][2]. Verification Steps: 1. Import Codecov's PGP public key: This is a one-time step. You can import the public key from a trusted source, such as Keybase or directly from Codecov's servers [3][1][4]. Example command: curl https://keybase.io/codecovsecops/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import [3] The Codecov PGP public key details are: Key ID: ED779869 [1][2] Key Fingerprint: 2703 4E7F DB85 0E0B BC2C 62FF 806B B28A ED77 9869 [1][2] 2. Download the required files: For your specific operating system and architecture, download the uploader binary, its corresponding SHA256SUM file, and the SHA256SUM.sig signature file [1][2]. Example (Linux): curl -Os https://cli.codecov.io/latest/linux/codecov curl -Os https://cli.codecov.io/latest/linux/codecov.SHA256SUM curl -Os https://cli.codecov.io/latest/linux/codecov.SHA256SUM.sig [3] 3. Verify the signature: Use GPG to verify that the SHA256SUM file was legitimately signed by Codecov [1][2]. Example: gpg --verify codecov.SHA256SUM.sig codecov.SHA256SUM [1] 4. Verify the binary checksum: Once the signature is verified, confirm that the binary matches the checksum provided in the SHA256SUM file [1][2]. Example: shasum -a 256 -c codecov.SHA256SUM [3][1] Official documentation provides these instructions for various environments, including Linux, macOS, and Alpine [3][1][2]. Always ensure you are downloading from the official Codecov domains (e.g., cli.codecov.io or uploader.codecov.io) [3][1][2].
Citations:
Add integrity verification for the Codecov uploader binary.
Downloading and executing an unsigned binary directly from the internet is a supply chain security risk. The Codecov uploader was compromised in a 2021 supply chain attack. Codecov provides GPG signatures and checksums for verification.
🛡️ Suggested fix with integrity verification
commands: | curl -Os https://uploader.codecov.io/latest/linux/codecov + curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM + curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig + curl https://keybase.io/codecovsecops/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import + gpgv codecov.SHA256SUM.sig codecov.SHA256SUM + shasum -a 256 -c codecov.SHA256SUM chmod +x codecov ./codecov upload-process --token=$(cat /var/run/secrets/codecov/token)Alternatively, if GPG tooling is unavailable in the container, at minimum verify the SHA256 checksum.
🤖 Prompt for AI Agents