v4 of the Codecov Action uses the CLI as the underlying upload. The CLI has helped to power new features including local upload, the global upload token, and new upcoming features.
Breaking Changes
The Codecov Action runs as a node20 action due to node16 deprecation. See this post from GitHub on how to migrate.
Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token). This doc shows instructions on how to add the Codecov token.
OS platforms have been added, though some may not be automatically detected. To see a list of platforms, see our CLI download page
Various arguments to the Action have been changed. Please be aware that the arguments match with the CLI's needs
v3 versions and below will not have access to CLI features (e.g. global upload token, ATS).
v4 represents a move from the universal uploader to the Codecov CLI. Although this will unlock new features for our users, the CLI is not yet at feature parity with the universal uploader.
Breaking Changes
No current support for aarch64 and alpine architectures.
We are rolling out a feature in April/May 2024 that improves the reliability and performance of analyzing code when analyzing a compiled language with the autobuildbuild mode. #2235
Fix a bug where the init Action would fail if --overwrite was specified in CODEQL_ACTION_EXTRA_OPTIONS. #2245
Update default CodeQL bundle version to 2.17.1. #2247
3.25.0 - 15 Apr 2024
The deprecated feature for extracting dependencies for a Python analysis has been removed. #2224
As a result, the following inputs and environment variables are now ignored:
The setup-python-dependencies input to the init Action
The CODEQL_ACTION_DISABLE_PYTHON_DEPENDENCY_INSTALLATION environment variable
We recommend removing any references to these from your workflows. For more information, see the release notes for CodeQL Action v3.23.0 and v2.23.0.
Automatically overwrite an existing database if found on the filesystem. #2229
Bump the minimum CodeQL bundle version to 2.12.6. #2232
A more relevant log message and a diagnostic are now emitted when the file program is not installed on a Linux runner, but is required for Go tracing to succeed. #2234
3.24.10 - 05 Apr 2024
Update default CodeQL bundle version to 2.17.0. #2219
Add a deprecation warning for customers using CodeQL version 2.12.5 and earlier. These versions of CodeQL were discontinued on 26 March 2024 alongside GitHub Enterprise Server 3.8, and will be unsupported by CodeQL Action versions 3.25.0 and later and versions 2.25.0 and later. #2220
If you are using one of these versions, please update to CodeQL CLI version 2.12.6 or later. For instance, if you have specified a custom version of the CLI using the 'tools' input to the 'init' Action, you can remove this input to use the default version.
Alternatively, if you want to continue using a version of the CodeQL CLI between 2.11.6 and 2.12.5, you can replace github/codeql-action/*@v3 by github/codeql-action/*@v3.24.10 and github/codeql-action/*@v2 by github/codeql-action/*@v2.24.10 in your code scanning workflow to ensure you continue using this version of the CodeQL Action.
3.24.9 - 22 Mar 2024
Update default CodeQL bundle version to 2.16.5. #2203
3.24.8 - 18 Mar 2024
Improve the ease of debugging extraction issues by increasing the verbosity of the extractor logs when running in debug mode. #2195
3.24.7 - 12 Mar 2024
Update default CodeQL bundle version to 2.16.4. #2185
3.24.6 - 29 Feb 2024
No user facing changes.
3.24.5 - 23 Feb 2024
Update default CodeQL bundle version to 2.16.3. #2156
... (truncated)
Commits
8566d50 Add regression test for double --overwrite
453a956 Merge pull request #2243 from github/dependabot/npm_and_yarn/npm-9b31496ffc
Bumps the github-actions group with 20 updates:
3
4
6
7
4
5
3
4
2.3.1
2.3.2
2
3
3
4
4
5
3.7.0
5.0.0
1.2.0
1.3.0
1.8.0
1.9.3
4
5
4
5
0.8.3
0.9.0
5
6
3
4
3.1.2
3.5.0
0.14.3
0.15.10
23
26
8
9
Updates
peter-evans/create-or-update-comment
from 3 to 4Release notes
Sourced from peter-evans/create-or-update-comment's releases.
... (truncated)
Commits
71345be
feat: update runtime to node 20 (#306)d41bfe3
build(deps-dev): bump prettier from 3.2.3 to 3.2.4 (#305)73b4b9e
build(deps-dev): bump@types/node
from 18.19.7 to 18.19.8 (#304)b865fac
build(deps-dev): bump@types/node
from 18.19.6 to 18.19.7 (#303)52b668a
build(deps-dev): bump eslint-plugin-jest from 27.6.1 to 27.6.3 (#302)974f56a
build(deps-dev): bump prettier from 3.1.1 to 3.2.3 (#301)2cbfe8b
build(deps-dev): bump@types/node
from 18.19.4 to 18.19.6 (#300)761872a
build(deps-dev): bump eslint-plugin-prettier from 5.1.2 to 5.1.3 (#299)72c3238
build(deps-dev): bump@types/node
from 18.19.3 to 18.19.4 (#298)07daf7b
build(deps-dev): bump eslint-plugin-jest from 27.6.0 to 27.6.1 (#297)Updates
actions/github-script
from 6 to 7Release notes
Sourced from actions/github-script's releases.
... (truncated)
Commits
60a0d83
Merge pull request #440 from actions/joshmgross/v7.0.1b7fb200
Update version to 7.0.112e22ed
Merge pull request #439 from actions/joshmgross/avoid-setting-base-urld319f8f
Avoid settingbaseUrl
to undefined when input is not providede69ef54
Merge pull request #425 from actions/joshmgross/node-20ee0914b
Update licensesd6fc56f
Use@types/node
for Node 20384d6cf
Fix quotations in tests8472492
Only validate GraphQLpreviews
84903f5
Removenode-fetch
from typeUpdates
magnetikonline/action-golang-cache
from 4 to 5Release notes
Sourced from magnetikonline/action-golang-cache's releases.
Commits
fcca93e
Bumpactions/setup-go@v5
/actions/cache@v4
ec2faaf
Useformat()
workflow expression to append optionalinputs.cache-key-suffix
1bec231
Set explicit emptydefault:
forgo-version
andgo-version-file
inputsd3e977b
Improveaction.yaml
description47ba946
UpdateREADME.md
Updates
codecov/codecov-action
from 3 to 4Release notes
Sourced from codecov/codecov-action's releases.
... (truncated)
Changelog
Sourced from codecov/codecov-action's changelog.
... (truncated)
Commits
8450866
chore(release): v4.3.0 (#1366)e841909
build(deps): bump undici from 5.28.3 to 5.28.4 (#1361)363a65a
feat: add network params (#1365)640b86a
build(deps-dev): bump@typescript-eslint/parser
from 7.5.0 to 7.6.0 (#1363)375c033
build(deps-dev): bump@typescript-eslint/eslint-plugin
from 7.5.0 to 7.6.0 (#...d701256
build(deps): bump github/codeql-action from 3.24.9 to 3.24.10 (#1360)0bb547a
build(deps-dev): bump typescript from 5.4.3 to 5.4.4 (#1355)55e8381
fix: automatically detect if using GitHub enterprise (#1356)7afa10e
fix: use_oidc shoudl be required false (#1353)d820d60
feat: allow for authentication via OIDC token (#1330)Updates
contributor-assistant/github-action
from 2.3.1 to 2.3.2Release notes
Sourced from contributor-assistant/github-action's releases.
Commits
dbc1c64
docs(contributor): contrib-readme-action has updated readme87da410
Merge pull request #147 from tada5hi/pr-sign-commitf4faf18
fix: create empty commit for custom pr sign comment as wellUpdates
github/codeql-action
from 2 to 3Release notes
Sourced from github/codeql-action's releases.
... (truncated)
Changelog
Sourced from github/codeql-action's changelog.
... (truncated)
Commits
8566d50
Add regression test for double--overwrite
453a956
Merge pull request #2243 from github/dependabot/npm_and_yarn/npm-9b31496ffcc7a8056
simplify while loop71e6077
Merge branch 'main' into nickfyson/speculative-script-fixdb2b739
Fix PR link in changelogb8e2556
Merge pull request #2242 from github/henrymercer/even-more-configuration-errorsd8b8ad0
Update checked-in dependenciesfc090c4
Bump the npm group with 4 updatesea78e51
Merge branch 'main' into henrymercer/autobuild-with-direct-tracing14eab91
Improve changelog noteUpdates
actions/dependency-review-action
from 3 to 4Release notes
Sourced from actions/dependency-review-action's releases.