Bug: File tree from different repo is displayed

[mvorisek]

Describe the bug A clear and concise description of what the bug is.

To Reproduce Steps to reproduce the behavior:

1. Go to https://app.codecov.io/gh/atk4/ui
2. In the "Code Tree" (file tree) in the bottom of the page click on "src"
3. Notice the files are from https://github.com/atk4/data repo instead of https://github.com/atk4/ui

Expected behavior

https://app.codecov.io/gh/atk4/ui must never display anything from unrelated repo

Screenshots

[spalmurray-codecov]

Hey @mvorisek! Super weird behavior here. Looking through the commits on ui and also the uploads on ui. It seems to me like you're uploading coverage from your data repo to the ui repo on Codecov.

The only ways I can think of for this to occur are

1. You're using ui's repository upload token for your data uploads, or
2. you're using a global upload token and passing the ui slug when you mean to use data.

Can you confirm if either of these are true?

[mvorisek]

Thank for your quick reaction.

Here is how we upload the coverage:

• in ui repo: https://github.com/atk4/ui/blob/5.2.0/.github/workflows/test-unit.yml#L225-L231 and https://github.com/atk4/ui/blob/5.2.0/.github/workflows/test-unit.yml#L454-L460
• in data repo: https://github.com/atk4/data/blob/5.2.0/.github/workflows/test-unit.yml#L269-L275

The secrets.CODECOV_TOKEN is defined at GH org level, ie. one token for all repos:

I am not sure what you mean by "slug" in your 2nd point, I would say we do not pass any.

[spalmurray-codecov]

Okay cool - can you confirm that the secret you're using is the organization's global upload token?

In app, see Org > Settings > Global Upload Token

[spalmurray-codecov]

Once you've confirmed that, you'll need to pass the appropriate repo slug in your 3 Codecov action calls. Here's an example:

- name: Upload coverage reports to Codecov
    uses: codecov/codecov-action@v4
    with:
      token: ${{ secrets.CODECOV_TOKEN }}
      slug: atk4/ui

[spalmurray-codecov]

One of these two steps is going wrong at the moment, but with these changes, you should be good!

[mvorisek]

Okay cool - can you confirm that the secret you're using is the organization's global upload token?

In app, see Org > Settings > Global Upload Token

I was not able to display the old one. But I copied the one from https://app.codecov.io/account/gh/atk4/org-upload-token into https://github.com/organizations/atk4/settings/secrets/actions now and saved it. It seems the original token was somehow bad, as in atk4/core repo, atk4/ui was reported before this change - https://github.com/atk4/core/actions/runs/11962889109/job/33352230876#step:11:197 . I have no idea why. If that token was for atk4/ui repo, why it not worked in atk4/repo?

slug: atk4/core - before I changed the token, I tried this too, but this did not work (atk4/ui was still reported).

For me, this is fixed now (with token copied from https://app.codecov.io/account/gh/atk4/org-upload-token), I will reopen this issue if needed. Thank you for your perfect help ❤

[spalmurray-codecov]

If that's the case, the secret was probably a repository level token for atk4/ui somehow. Regardless, glad I could help!