Merge pull request #54135 from thaJeztah/codecov_oidc
ci: use OIDC authentication for Codecov uploads
This commit is contained in:
6 files changed
+32
-22
No files matched your search
@@ -17,9 +17,6 @@ on:
|
||||
required: false
|
||||
type: string
|
||||
default: ""
|
||||
secrets:
|
||||
CODECOV_TOKEN:
|
||||
required: false
|
||||
|
||||
env:
|
||||
GO_VERSION: "1.26.10"
|
||||
@@ -30,6 +27,9 @@ env:
|
||||
|
||||
jobs:
|
||||
unit:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
runs-on: ubuntu-26.04${{ inputs.runnerSuffix }}
|
||||
timeout-minutes: 120 # guardrails timeout for the whole job
|
||||
continue-on-error: ${{ github.event_name != 'pull_request' }}
|
||||
@@ -93,7 +93,7 @@ jobs:
|
||||
directory: ./bundles
|
||||
env_vars: RUNNER_OS
|
||||
flags: unit,${{ inputs.arch }}
|
||||
token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
|
||||
use_oidc: true
|
||||
-
|
||||
name: Upload reports
|
||||
if: always()
|
||||
|
||||
@@ -25,9 +25,6 @@ on:
|
||||
required: true
|
||||
type: string
|
||||
default: "graphdriver"
|
||||
secrets:
|
||||
CODECOV_TOKEN:
|
||||
required: false
|
||||
|
||||
env:
|
||||
GO_VERSION: "1.26.10"
|
||||
@@ -172,6 +169,9 @@ jobs:
|
||||
});
|
||||
|
||||
integration:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
runs-on: ${{ matrix.runner }}
|
||||
timeout-minutes: 120 # guardrails timeout for the whole job
|
||||
continue-on-error: ${{ github.event_name != 'pull_request' }}
|
||||
@@ -282,7 +282,7 @@ jobs:
|
||||
directory: ./bundles/test-integration
|
||||
env_vars: RUNNER_OS
|
||||
flags: integration,${{ inputs.arch }},${{ matrix.mode }}
|
||||
token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
|
||||
use_oidc: true
|
||||
-
|
||||
name: Test daemon logs
|
||||
if: always()
|
||||
@@ -425,6 +425,9 @@ jobs:
|
||||
});
|
||||
|
||||
integration-cli:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
runs-on: ubuntu-26.04${{ inputs.runnerSuffix }}
|
||||
timeout-minutes: 120 # guardrails timeout for the whole job
|
||||
continue-on-error: ${{ github.event_name != 'pull_request' }}
|
||||
@@ -506,7 +509,7 @@ jobs:
|
||||
directory: ./bundles/test-integration
|
||||
env_vars: RUNNER_OS
|
||||
flags: integration-cli,${{ inputs.arch }}
|
||||
token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
|
||||
use_oidc: true
|
||||
-
|
||||
name: Test daemon logs
|
||||
if: always()
|
||||
|
||||
@@ -24,9 +24,6 @@ on:
|
||||
required: false
|
||||
type: string
|
||||
default: external
|
||||
secrets:
|
||||
CODECOV_TOKEN:
|
||||
required: false
|
||||
|
||||
env:
|
||||
GO_VERSION: "1.26.10"
|
||||
@@ -105,6 +102,9 @@ jobs:
|
||||
retention-days: 2
|
||||
|
||||
unit-test:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
runs-on: ${{ inputs.os }}
|
||||
timeout-minutes: 120 # guardrails timeout for the whole job
|
||||
env:
|
||||
@@ -156,7 +156,7 @@ jobs:
|
||||
directory: bundles
|
||||
env_vars: RUNNER_OS
|
||||
flags: unit
|
||||
token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
|
||||
use_oidc: true
|
||||
-
|
||||
name: Upload reports
|
||||
if: always()
|
||||
@@ -229,6 +229,9 @@ jobs:
|
||||
echo "$matrix"
|
||||
|
||||
integration-test:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
runs-on: ${{ inputs.os }}
|
||||
timeout-minutes: 120 # guardrails timeout for the whole job
|
||||
continue-on-error: ${{ inputs.storage == 'snapshotter' && github.event_name != 'pull_request' }}
|
||||
@@ -375,7 +378,7 @@ jobs:
|
||||
directory: bundles
|
||||
env_vars: RUNNER_OS
|
||||
flags: integration,${{ matrix.runtime }}
|
||||
token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533
|
||||
use_oidc: true
|
||||
-
|
||||
name: Docker info
|
||||
run: |
|
||||
|
||||
@@ -80,6 +80,9 @@ jobs:
|
||||
path: /tmp/dev-image-${{ matrix.arch }}.tar
|
||||
|
||||
test:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
name: test (${{ matrix.arch }}, ${{ matrix.storage }})
|
||||
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
||||
needs:
|
||||
@@ -108,10 +111,11 @@ jobs:
|
||||
storage: ${{ matrix.storage }}
|
||||
runnerSuffix: ${{ matrix.runnerSuffix }}
|
||||
extraModes: ${{ matrix.extraModes }}
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
|
||||
test-unit:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
||||
needs:
|
||||
- build-dev
|
||||
@@ -128,8 +132,6 @@ jobs:
|
||||
with:
|
||||
arch: ${{ matrix.arch }}
|
||||
runnerSuffix: ${{ matrix.runnerSuffix }}
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
|
||||
validate-prepare:
|
||||
runs-on: ubuntu-26.04
|
||||
|
||||
@@ -20,6 +20,9 @@ jobs:
|
||||
pull-requests: read
|
||||
uses: ./.github/workflows/.dco.yml
|
||||
run:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
needs: validate-dco
|
||||
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
||||
uses: ./.github/workflows/.windows.yml
|
||||
@@ -38,5 +41,3 @@ jobs:
|
||||
storage: ${{ matrix.storage }}
|
||||
containerd: ${{ matrix.containerd }}
|
||||
send_coverage: true
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
@@ -25,6 +25,9 @@ jobs:
|
||||
uses: ./.github/workflows/.dco.yml
|
||||
|
||||
run:
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
||||
needs: validate-dco
|
||||
if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }}
|
||||
uses: ./.github/workflows/.windows.yml
|
||||
@@ -43,5 +46,3 @@ jobs:
|
||||
storage: ${{ matrix.storage }}
|
||||
containerd: ${{ matrix.containerd }}
|
||||
send_coverage: false
|
||||
secrets:
|
||||
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
|
||||
Reference in new issue
Block a user