ci: enable coverage for missing TAP workflows - #5995
Conversation
📝 WalkthroughWalkthroughThe three GitHub Actions workflows now run on coverage-enabled Ubuntu 24 distributions, check out source paths for coverage resolution, enable coverage during tests, archive reports, and conditionally upload them to Codecov. ChangesCI coverage integration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant Ubuntu24Coverage
participant TestSuite
participant Codecov
GitHubActions->>Ubuntu24Coverage: Start coverage-enabled test job
Ubuntu24Coverage->>TestSuite: Run tests with COVERAGE=1
TestSuite-->>Ubuntu24Coverage: Generate .info coverage report
Ubuntu24Coverage->>GitHubActions: Archive coverage report
GitHubActions->>Codecov: Upload existing coverage report
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci-basictests.yml:
- Line 83: Replace permissions: write-all with the explicitly reduced permission
map required by the checks-created OIDC path, including read access for
checkout, Actions/artifact/package-container APIs and only the necessary write
scopes. Apply the identical permission map at
.github/workflows/ci-basictests.yml:83-83 and
.github/workflows/ci-legacy-g2.yml:83-83.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f868ce45-f22c-4b86-9d3c-4243552d99d8
📒 Files selected for processing (3)
.github/workflows/ci-basictests.yml.github/workflows/ci-legacy-g2.yml.github/workflows/ci-taptests-pgsql-cluster.yml
📜 Review details
🧰 Additional context used
🪛 zizmor (1.29.0)
.github/workflows/ci-basictests.yml
[error] 83-83: overly broad permissions (excessive-permissions): uses write-all permissions
(excessive-permissions)
.github/workflows/ci-legacy-g2.yml
[error] 83-83: overly broad permissions (excessive-permissions): uses write-all permissions
(excessive-permissions)
🔇 Additional comments (3)
.github/workflows/ci-basictests.yml (1)
84-87: LGTM!Also applies to: 114-120, 136-136, 241-241, 286-316
.github/workflows/ci-legacy-g2.yml (1)
84-89: LGTM!Also applies to: 111-117, 132-132, 240-240, 274-304
.github/workflows/ci-taptests-pgsql-cluster.yml (1)
66-66: LGTM!Also applies to: 91-97, 200-200, 231-261
| tests: | ||
| needs: pick-runner | ||
| runs-on: ${{ fromJson(needs.pick-runner.outputs.runson) }} | ||
| permissions: write-all |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippets =="
for f in .github/workflows/ci-basictests.yml .github/workflows/ci-legacy-g2.yml; do
echo "--- $f"
sed -n '1,180p' "$f" | nl -ba
done
echo "== permissions occurrences in workflows =="
rg -n "permissions:" .github/workflows || true
echo "== action usage and token-dependent steps in affected workflows =="
python3 - <<'PY'
from pathlib import Path
for p in map(Path, ['.github/workflows/ci-basictests.yml','.github/workflows/ci-legacy-g2.yml']):
print(f'--- {p}')
lines=p.read_text().splitlines()
for i,l in enumerate(lines,1):
if 'GITHUB_TOKEN' in l or 'gh api' in l or 'ghcr.io' in l or 'actions/checkout' in l or 'actions/download-artifact' in l or 'upload-artifact' in l or 'checks:' in l or 'id-token' in l:
print(f'{i}: {l}')
PY
echo "== docs/config references for codecov-action token/permissions =="
rg -n "codecov-action|codecov|id-token|permissions" .github/workflows README.md pyproject.toml setup.cfg setup.py 2>/dev/null || trueRepository: sysown/proxysql
Length of output: 257
🌐 Web query:
codecov-action GITHUB_TOKEN permissions id-token write checks write documentation
💡 Result:
To use codecov/codecov-action with OIDC, the workflow/job that runs the action must grant the GitHub Actions token permission id-token: write (at workflow or job level). [1][2] Example: permissions: id-token: write This is specifically called out in the codecov-action README as required for OIDC to work. [1][2] About other permission scopes (checks/write and documentation): GitHub’s permissions block controls what scopes the automatically generated GITHUB_TOKEN has. Any permission not listed is set to none, and PRs from forks are treated specially (they receive a read token regardless of the configured settings). [3] In the materials I found, the codecov-action documentation only states a requirement for id-token: write (for OIDC). I did not find an official statement from codecov-action that you must add checks: write or documentation (or contents) permissions specifically for the upload step. [1][2][3] Note: In GitHub, GITHUB_TOKEN permissions are not a way to directly “write documentation” or “write checks” in the repository unless you explicitly grant the corresponding scopes in permissions: for that job/workflow. [3] If you share your exact workflow YAML (especially whether you use use_oidc: true / OIDC vs token: upload), I can tell you the minimal permissions block to match it.
Citations:
- 1: https://github.com/codecov/codecov-action/blob/main/README.md
- 2: https://github.com/codecov/codecov-action
- 3: https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow snippets =="
for f in .github/workflows/ci-basictests.yml .github/workflows/ci-legacy-g2.yml; do
echo "--- $f"
sed -n '1,180p' "$f" | awk '{printf "%5d: %s\n", NR, $0}'
done
echo "== permissions occurrences in workflows =="
rg -n "permissions:" .github/workflows || true
echo "== token/action references in affected workflows =="
python3 - <<'PY'
from pathlib import Path
for p in map(Path, ['.github/workflows/ci-basictests.yml','.github/workflows/ci-legacy-g2.yml']):
print(f'--- {p}')
lines=p.read_text().splitlines()
for i,l in enumerate(lines,1):
if any(s in l for s in ['GITHUB_TOKEN','gh api','ghcr.io','actions/checkout','actions/download-artifact','upload-artifact','codecov',
'checks:', 'id-token', 'contents:', 'packages:', 'actions:']):
print(f'{i}: {l}')
PY
echo "== local references to codecov usage =="
rg -n "codecov|codecov-action|GITHUB_TOKEN|permissions:" README.md pyproject.toml setup.cfg setup.py .github 2>/dev/null || trueRepository: sysown/proxysql
Length of output: 50371
🌐 Web query:
GitHub Actions GITHUB_TOKEN checks permission required to create a check suite check run documentation
💡 Result:
To create a check run or check suite using the GITHUB_TOKEN in a GitHub Actions workflow, you must explicitly grant the token the write permission for checks [1][2]. By default, the GITHUB_TOKEN may not have sufficient permissions to interact with the Checks API. You can configure this by adding a permissions block to your workflow file, either at the workflow level or the specific job level [3][4]. Example configuration: permissions: checks: write contents: read Once this permission is granted, the GITHUB_TOKEN behaves as a GitHub App installation access token, allowing it to interact with the check runs and check suites REST API endpoints [5][6][7]. It is important to note that while the Checks API is primarily designed for GitHub Apps, the GITHUB_TOKEN provided to GitHub Actions workflows is treated as an installation access token, which enables this functionality [5]. If you encounter a Resource not accessible by integration error, it is almost always due to missing or insufficient permissions in this block [1][2]. Finally, ensure that you follow the principle of least privilege by only granting the minimum permissions required for your workflow to function [3][5].
Citations:
- 1: https://github.com/LouisBrunner/checks-action
- 2: https://github.com/marketplace/actions/github-checks
- 3: https://docs.github.com/en/actions/tutorials/authenticate-with-github_token
- 4: https://docs.github.com/actions/reference/authentication-in-a-workflow
- 5: https://docs.github.com/en/actions/concepts/security/github_token
- 6: https://docs.github.com/en/rest/checks/runs
- 7: https://docs.github.com/en/rest/checks/runs?apiVersion=latest
🌐 Web query:
LouisBrunner checks-action v2.0.0 permissions checks write contents read
💡 Result:
To use the LouisBrunner/checks-action@v2.0.0 GitHub Action successfully, you must explicitly grant the necessary permissions to the GITHUB_TOKEN within your workflow job [1][2]. This is required to resolve the "Error: Resource not accessible by integration" which occurs because the default permissions for the GITHUB_TOKEN are often insufficient for creating check runs [1][3]. The following permissions are required in your job configuration: permissions: checks: write contents: read Including these permissions is necessary because when you explicitly define a permissions block in a job, all other permissions are set to none [3]. Therefore, if your workflow also requires access to your repository's code (e.g., for an actions/checkout step), you must include contents: read to ensure that access is maintained [3][4]. For example, your job configuration should look like this: jobs: test_something: runs-on: ubuntu-latest permissions: checks: write contents: read steps: - uses: actions/checkout@v4 - uses: LouisBrunner/checks-action@v2.0.0 with: token: ${{ secrets.GITHUB_TOKEN }} #... other inputs
Citations:
- 1: https://github.com/LouisBrunner/checks-action
- 2: https://github.com/LouisBrunner/checks-action/tree/refs/heads/main
- 3: Error: Resource not accessible by integration LouisBrunner/checks-action#190
- 4: https://github.com/LouisBrunner/checks-action/blob/main/.github/workflows/examples.yml
Replace write-all with explicit permissions.
write-all grants every default GITHUB_TOKEN write scope. This job only needs explicit read access for checkout, Action/artifact/packaged-container APIs, plus write scopes for the checks-created OIDC path.
.github/workflows/ci-basictests.yml#L83-L83: use the reduced permission map below..github/workflows/ci-legacy-g2.yml#L83-L83: use the same reduced permission map.
Suggested permission map
- permissions: write-all
+ permissions:
+ actions: read
+ checks: write
+ contents: read
+ id-token: write
+ packages: read📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: write-all | |
| permissions: | |
| actions: read | |
| checks: write | |
| contents: read | |
| id-token: write | |
| packages: read |
🧰 Tools
🪛 zizmor (1.29.0)
[error] 83-83: overly broad permissions (excessive-permissions): uses write-all permissions
(excessive-permissions)
📍 Affects 2 files
.github/workflows/ci-basictests.yml#L83-L83(this comment).github/workflows/ci-legacy-g2.yml#L83-L83
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-basictests.yml at line 83, Replace permissions:
write-all with the explicitly reduced permission map required by the
checks-created OIDC path, including read access for checkout,
Actions/artifact/package-container APIs and only the necessary write scopes.
Apply the identical permission map at .github/workflows/ci-basictests.yml:83-83
and .github/workflows/ci-legacy-g2.yml:83-83.
Source: Linters/SAST tools
|
1 participant
Enables integration coverage for TAP workflows that currently execute ProxySQL tests without contributing LCOV:
ci-legacy-g2.ymlci-basictests.ymlci-taptests-pgsql-cluster.ymlEach workflow now uses the existing
ubuntu24-tap-genai-gcovhandoff, checks out the source roots Codecov needs to resolve LCOV paths, setsCOVERAGE=1, archives the generated coverage report, and uploads it under the existingintegration-testsCodecov flag using OIDC.The changes were generated and validated with
git diff --checkplus an audit that flags any unclassified workflow invokingrun-tests-isolated.bashwithout coverage.The separate centralized sparse-checkout
codecov.ymlmaterialization fix is being applied to PR #5984, because that harness is executed from the tested commit rather than from thisGH-Actionsbranch.Summary by CodeRabbit