Comment the codecov report link on PRs
What the developer wrote
Authored by Matt Corallo
Comment the codecov report link on PRs
Codecov's own PR comment depends on CI environment detection, which does
not work under Forgejo, so post a link to the commit's coverage report
from the coverage job instead. A hidden marker keeps the comment sticky
(updated in place rather than re-posted on every push), and the step
only runs for pull requests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
What changed, and why it matters
This change adds a CI workflow step that automatically posts or updates a link to a code-coverage report on pull requests. It is purely a developer-convenience automation and does not touch any production code, cryptography, networking, or user data handling.
No security action required. As a routine hygiene measure, verify that `FORGEJO_TOKEN` has only the minimum required scope (e.g., issue/PR comment write access) and is not granted broader repository or admin permissions.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit extends .forgejo/workflows/build.yml with a new job step that uses a Forgejo API token to comment a Codecov report URL on PRs. It reads secrets.FORGEJO_TOKEN and github.event.pull_request.number, queries issue comments, and either PATCHes an existing sticky comment or POSTs a new one. The token is used only to write a comment on the same repository’s PR; there is no evidence of unsafe handling, injection of untrusted data into shell commands, or exposure of secrets in logs. The URL is constructed from repository and commit SHA values controlled by the CI environment.
Changed components
.forgejo/workflows/build.ymlInspect captured patch +29 / −0
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
index 7a7453c..fcc80d7 100644
--- a/.forgejo/workflows/build.yml
+++ b/.forgejo/workflows/build.yml
@@ -115,6 +115,35 @@ jobs:
# Maybe if codecov wasn't broken we wouldn't need to do this...
./codecov --verbose upload-process --disable-search --fail-on-error $CC -f fuzz-fake-hashes-codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'fuzzing-fake-hashes'
./codecov --verbose upload-process --disable-search --fail-on-error $CC -f fuzz-real-hashes-codecov.json -t "f421b687-4dc2-4387-ac3d-dc3b2528af57" -F 'fuzzing-real-hashes'
+ - name: Comment the codecov report link on the PR
+ # Codecov's own PR comment relies on CI environment detection (broken
+ # under Forgejo), so post a link to the commit's report ourselves. A
+ # hidden marker makes the comment sticky: update it instead of piling up
+ # a new comment on every push. Only runs for pull requests.
+ if: github.event.pull_request.number
+ env:
+ API: ${{ github.server_url }}/api/v1
+ REPO: ${{ github.repository }}
+ FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+ run: |
+ set -eu
+ AUTH="Authorization: token ${FORGEJO_TOKEN}"
+ URL="https://app.codecov.io/github/${REPO}/commit/${CODECOV_SHA}"
+ MARKER="<!-- codecov-report-link -->"
+ BODY="${MARKER}"$'\n'"[Coverage report for this commit on Codecov](${URL})"
+
+ # Update an existing sticky comment if present, otherwise create one.
+ CID="$(curl -fsS -H "$AUTH" "$API/repos/$REPO/issues/$CODECOV_PR/comments?limit=50" \
+ | jq -r --arg m "$MARKER" 'map(select((.body // "") | contains($m))) | .[0].id // empty')"
+ if [ -n "$CID" ]; then
+ curl -fsS -H "$AUTH" -H 'Content-Type: application/json' \
+ -X PATCH "$API/repos/$REPO/issues/comments/$CID" \
+ -d "$(jq -n --arg b "$BODY" '{body: $b}')" >/dev/null
+ else
+ curl -fsS -H "$AUTH" -H 'Content-Type: application/json' \
+ -X POST "$API/repos/$REPO/issues/$CODECOV_PR/comments" \
+ -d "$(jq -n --arg b "$BODY" '{body: $b}')" >/dev/null
+ fi
benchmark:
runs-on: debian-trixie
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.