3 ms·
What's the difference between this and codecov? Do you access deployment secrets to run the checks?
by celticninja 6y ago
What's the difference between this and codecov? Do you access deployment secrets to run the checks?
- serlank 6y agoThe coverage reports are generated by the normal build process and then uploaded along with an access token used to verify your access to the repository. If the GitHub action is used for this upload, this is a special token GitHub creates that's only valid for the duration of the build, and files uploaded are limited to that specified for the action. In light of recent events I can totally understand when there's a certain level of discomfort running an action that uploads data, but that's also why the upload can be done either via the GitHub action, running a Docker image, or manually (there's a bit about this in the documentation). I think the most important thing we've learned, and this is maybe not just limited to coverage uploaders, is that build steps should be isolated with only the information they need. Eg. there's no need to do the upload in an environment where credentials and source code is available.