From f35db125c074d871c219c3dcef69bed314f4106c Mon Sep 17 00:00:00 2001 From: FMSMITH91 <12152698+FMSMITH91@users.noreply.github.com> Date: Sat, 8 Aug 2026 14:28:08 -0500 Subject: [PATCH] ci: wire the Codacy coverage upload so it self-activates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The step was commented out with instructions, which meant enabling it needed a second PR that someone has to remember. It is live now and guarded by `if: env.CODACY_PROJECT_TOKEN != ''`, so with no secret it simply skips and the job stays green — and it starts uploading by itself the moment the secret is added. The secret has to be job-level env for the step's `if` to see it. The comment now names WHICH token: a repository token (Codacy → the repo → Settings → Integrations), not an account one. An account token carries the whole Codacy user's permissions across every repo; the repository token is scoped to this one, so a leak cannot reach anything else. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c604563..c08603a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -66,6 +66,8 @@ jobs: coverage: name: coverage runs-on: ubuntu-latest + env: + CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} # Informational, and deliberately a SEPARATE job: it re-runs the suites under tracing, which is # slower, and the gate above should stay the fast answer. Codacy has a 60% coverage goal that # has always read as "not reported" because nothing ever produced a report. @@ -107,10 +109,11 @@ jobs: coverage.xml coverage.txt - # Codacy's coverage goal only lights up once a report is uploaded, which needs a project - # token this repo does not have. To enable: add CODACY_PROJECT_TOKEN as a repository secret - # and uncomment. Left off rather than half-wired, so the job never fails on a missing secret. - # - name: Send to Codacy - # env: - # CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }} - # run: bash <(curl -Ls https://coverage.codacy.com/get.sh) report -r coverage.xml + # Codacy's coverage goal only lights up once a report is uploaded. This step is live but + # self-disabling: with no CODACY_PROJECT_TOKEN secret it is skipped, and it starts working by + # itself the moment one is added — no second PR to remember. Use a REPOSITORY token (Codacy → + # the repo → Settings → Integrations), not an account token: it is scoped to this repo alone, + # so a leak cannot reach anything else. + - name: Send coverage to Codacy + if: env.CODACY_PROJECT_TOKEN != '' + run: bash <(curl -Ls https://coverage.codacy.com/get.sh) report -r coverage.xml