From 0bed3a0ccf13d53209bb4f67bbc31c64e5fdfc3c Mon Sep 17 00:00:00 2001 From: Pavel Kutsenko Date: Sun, 6 Sep 2026 20:43:49 +0300 Subject: [PATCH] fix: skip the codecov upload when the run has no token A Dependabot pull request runs without access to Actions secrets, so the upload token arrived empty and codecov refused a tokenless upload into a protected branch. With fail_ci_if_error the whole test job went red on every Python version while the suite itself passed, which is what both open dependency bumps were failing on. The token now reaches the step through the job environment, because a step if cannot read the secrets context, and the step is skipped when it is absent. Runs on main and on a branch in this repository upload exactly as before, and a pull request from a fork stops failing for the same reason. Nothing is lost on the skipped runs, since the coverage gate is the coverage report step that follows and it enforces the full hundred percent on its own. --- .github/workflows/ci.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d6521d8..c6a4bf6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,6 +48,9 @@ jobs: test: runs-on: ubuntu-latest + env: + # A step if cannot read secrets, so the token comes through the environment. + CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} strategy: fail-fast: false matrix: @@ -64,9 +67,11 @@ jobs: - run: uv run coverage run -m pytest # Uploads before the gate, because coverage report exits non-zero under 100 percent. - run: uv run coverage xml + # Dependabot and fork runs get no secrets, and codecov refuses a tokenless upload. - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 + if: env.CODECOV_TOKEN != '' with: - token: ${{ secrets.CODECOV_TOKEN }} + token: ${{ env.CODECOV_TOKEN }} files: coverage.xml fail_ci_if_error: true - run: uv run coverage report