Pass commit context to codecov explicitly in coverage job
What the developer wrote
Authored by Matt Corallo
Pass commit context to codecov explicitly in coverage job
Codecov auto-detects only a fixed set of CI providers and cannot detect
the Forgejo Actions environment, so it fails to determine the pull
request (and commit/branch) for uploads. Pass --slug, --sha, --branch,
and --pr to the codecov CLI explicitly, derived from the workflow
context, with --pr omitted on non-pull_request events.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
What changed, and why it matters
This commit is a routine CI workflow fix. It tells the Codecov coverage tool the correct repository, commit hash, branch, and pull request number because the project's Forgejo-based CI environment isn't on Codecov's auto-detection list. There is no change to the actual Rust Lightning code, cryptography, networking, or any user-facing behavior.
No security action required. This is a CI configuration improvement. Optionally, the project could consider whether the hardcoded Codecov upload token should be rotated/managed as a secret, but that is pre-existing and unchanged by this commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch modifies .forgejo/workflows/build.yml to export CODECOV_SLUG, CODECOV_SHA, CODECOV_BRANCH, and CODECOV_PR from GitHub/Forgejo workflow context and pass them explicitly to the codecov CLI via –git-service github –slug/–sha/–branch/–pr. It also omits –pr when the event is not a pull_request. The comments in the file jokingly note that one could fake a coverage report, but the change itself only supplies metadata that Codecov already needs; it does not introduce new upload tokens, disable authentication, or alter coverage generation.
Changed components
.forgejo/workflows/build.yml coverage jobInspect captured patch +17 / −3
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 7e0e518..7a7453c 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -62,6 +62,14 @@ jobs:
strategy:
fail-fast: false
runs-on: debian-trixie
+ # Codecov auto-detects only a fixed set of CI providers (not Forgejo), so the
+ # commit/branch/PR context is passed to the CLI explicitly in the steps below.
+ # CODECOV_PR is empty on non-pull_request events and is then omitted.
+ env:
+ CODECOV_SLUG: ${{ github.repository }}
+ CODECOV_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+ CODECOV_BRANCH: ${{ github.head_ref || github.ref_name }}
+ CODECOV_PR: ${{ github.event.pull_request.number }}
steps:
- name: Checkout source code
uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -77,10 +85,13 @@ jobs:
cargo llvm-cov --features rest-client,rpc-client,tokio,serde --codecov --hide-instantiations --output-path=target/codecov.json
curl --verbose -O https://cli.codecov.io/latest/linux/codecov
chmod +x codecov
+ # Pass the commit context manually since codecov can't detect Forgejo.
+ CC="--git-service github --slug $CODECOV_SLUG --sha $CODECOV_SHA --branch $CODECOV_BRANCH"
+ if [ -n "${CODECOV_PR:-}" ]; then CC="$CC --pr $CODECOV_PR"; fi
# Could you use this to fake the coverage report for your PR? Sure.
# Will anyone be impressed by your amazing coverage? No
# Maybe if codecov wasn't broken we wouldn't need to do this...
- ./codecov --verbose upload-process --disable-search --fail-on-error -f target/codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'tests'
+ ./codecov --verbose upload-process --disable-search --fail-on-error $CC -f target/codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'tests'
cargo clean
- name: Clone fuzzing corpus
run: git clone --depth=1 https://github.com/lightningdevkit/ldk-fuzzing-corpus.git fuzz/ldk-fuzzing-corpus
@@ -96,11 +107,14 @@ jobs:
- name: Run fuzz coverage generation
run: |
./contrib/generate_fuzz_coverage.sh --output-dir `pwd` --output-codecov-json
+ # Pass the commit context manually since codecov can't detect Forgejo.
+ CC="--git-service github --slug $CODECOV_SLUG --sha $CODECOV_SHA --branch $CODECOV_BRANCH"
+ if [ -n "${CODECOV_PR:-}" ]; then CC="$CC --pr $CODECOV_PR"; fi
# Could you use this to fake the coverage report for your PR? Sure.
# Will anyone be impressed by your amazing coverage? No
# Maybe if codecov wasn't broken we wouldn't need to do this...
- ./codecov --verbose upload-process --disable-search --fail-on-error -f fuzz-fake-hashes-codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'fuzzing-fake-hashes'
- ./codecov --verbose upload-process --disable-search --fail-on-error -f fuzz-real-hashes-codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'fuzzing-real-hashes'
+ ./codecov --verbose upload-process --disable-search --fail-on-error $CC -f fuzz-fake-hashes-codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'fuzzing-fake-hashes'
+ ./codecov --verbose upload-process --disable-search --fail-on-error $CC -f fuzz-real-hashes-codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'fuzzing-real-hashes'
benchmark:
runs-on: debian-trixie
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.