salesforce / TransmogrifAI

TransmogrifAI (pronounced trăns-mŏgˈrə-fī) is an AutoML library for building modular, reusable, strongly typed machine learning workflows on Apache Spark with minimal hand-tuning
https://transmogrif.ai
BSD 3-Clause "New" or "Revised" License
2.24k stars 392 forks source link

[WIP] use codecov orb instead of bash uploader #551

Closed crupley closed 3 years ago

crupley commented 3 years ago

Related issues Refer to issue(s) addressed in this pull request from Issues page.

As the result of the recent CodeCov security breach, it would be preferred to use a fixed version rather than automatically upgrade to another potentially insecure version.

Describe the proposed solution A clear and concise description of what the changes are.

Add the CodeCov script to repo and execute the static version.

This is the advised solution from CodeCov in response to my email request:

We are working on a new version that will compile into binaries. For now you can vendor the bash script into your repo and execute it there. That way it will not change until/unless you update it. Ticket: https://codecov.freshdesk.com/helpdesk/tickets/4907

Describe alternatives you've considered A clear and concise description of any alternative solutions or features you've considered.

Additional context Add any other context about the changes here.