From b43eb80adaa8d0c9fcc6198b0270e4ad52574504 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 5 Nov 2026 11:25:54 +0100 Subject: [PATCH] ci: use OIDC authentication for Codecov uploads Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication. Codecov supports tokenless uploads for public repositories, but authenticated uploads are still needed to protect coverage results on protected branches from unauthorized uploads. Grant `id-token: write` at the job level to allow Codecov to request a short-lived OIDC token. This permission does not grant repository write access, and scoping it to the job avoids granting it to other jobs added to the workflow in the future. Coverage uploads from forked pull requests continue to use Codecov's tokenless upload mechanism. See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc Signed-off-by: Sebastiaan van Stijn --- .github/workflows/.test-unit.yml | 8 ++++---- .github/workflows/.test.yml | 13 ++++++++----- .github/workflows/.windows.yml | 13 ++++++++----- .github/workflows/test.yml | 10 ++++++---- .github/workflows/windows-2022.yml | 5 +++-- .github/workflows/windows-2025.yml | 5 +++-- 6 files changed, 32 insertions(+), 22 deletions(-) diff --git a/.github/workflows/.test-unit.yml b/.github/workflows/.test-unit.yml index c6e6816913..880fad77a8 100644 --- a/.github/workflows/.test-unit.yml +++ b/.github/workflows/.test-unit.yml @@ -17,9 +17,6 @@ on: required: false type: string default: "" - secrets: - CODECOV_TOKEN: - required: false env: GO_VERSION: "1.26.10" @@ -30,6 +27,9 @@ env: jobs: unit: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc runs-on: ubuntu-26.04${{ inputs.runnerSuffix }} timeout-minutes: 120 # guardrails timeout for the whole job continue-on-error: ${{ github.event_name != 'pull_request' }} @@ -93,7 +93,7 @@ jobs: directory: ./bundles env_vars: RUNNER_OS flags: unit,${{ inputs.arch }} - token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533 + use_oidc: true - name: Upload reports if: always() diff --git a/.github/workflows/.test.yml b/.github/workflows/.test.yml index 7d6fa9ed33..5a077260cf 100644 --- a/.github/workflows/.test.yml +++ b/.github/workflows/.test.yml @@ -25,9 +25,6 @@ on: required: true type: string default: "graphdriver" - secrets: - CODECOV_TOKEN: - required: false env: GO_VERSION: "1.26.10" @@ -172,6 +169,9 @@ jobs: }); integration: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc runs-on: ${{ matrix.runner }} timeout-minutes: 120 # guardrails timeout for the whole job continue-on-error: ${{ github.event_name != 'pull_request' }} @@ -282,7 +282,7 @@ jobs: directory: ./bundles/test-integration env_vars: RUNNER_OS flags: integration,${{ inputs.arch }},${{ matrix.mode }} - token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533 + use_oidc: true - name: Test daemon logs if: always() @@ -425,6 +425,9 @@ jobs: }); integration-cli: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc runs-on: ubuntu-26.04${{ inputs.runnerSuffix }} timeout-minutes: 120 # guardrails timeout for the whole job continue-on-error: ${{ github.event_name != 'pull_request' }} @@ -506,7 +509,7 @@ jobs: directory: ./bundles/test-integration env_vars: RUNNER_OS flags: integration-cli,${{ inputs.arch }} - token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533 + use_oidc: true - name: Test daemon logs if: always() diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml index f26e7fc135..7df22e1f7f 100644 --- a/.github/workflows/.windows.yml +++ b/.github/workflows/.windows.yml @@ -24,9 +24,6 @@ on: required: false type: string default: external - secrets: - CODECOV_TOKEN: - required: false env: GO_VERSION: "1.26.10" @@ -105,6 +102,9 @@ jobs: retention-days: 2 unit-test: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc runs-on: ${{ inputs.os }} timeout-minutes: 120 # guardrails timeout for the whole job env: @@ -156,7 +156,7 @@ jobs: directory: bundles env_vars: RUNNER_OS flags: unit - token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533 + use_oidc: true - name: Upload reports if: always() @@ -229,6 +229,9 @@ jobs: echo "$matrix" integration-test: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc runs-on: ${{ inputs.os }} timeout-minutes: 120 # guardrails timeout for the whole job continue-on-error: ${{ inputs.storage == 'snapshotter' && github.event_name != 'pull_request' }} @@ -375,7 +378,7 @@ jobs: directory: bundles env_vars: RUNNER_OS flags: integration,${{ matrix.runtime }} - token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533 + use_oidc: true - name: Docker info run: | diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f634866236..38a58a74ff 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -80,6 +80,9 @@ jobs: path: /tmp/dev-image-${{ matrix.arch }}.tar test: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc name: test (${{ matrix.arch }}, ${{ matrix.storage }}) if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }} needs: @@ -108,10 +111,11 @@ jobs: storage: ${{ matrix.storage }} runnerSuffix: ${{ matrix.runnerSuffix }} extraModes: ${{ matrix.extraModes }} - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} test-unit: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }} needs: - build-dev @@ -128,8 +132,6 @@ jobs: with: arch: ${{ matrix.arch }} runnerSuffix: ${{ matrix.runnerSuffix }} - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} validate-prepare: runs-on: ubuntu-26.04 diff --git a/.github/workflows/windows-2022.yml b/.github/workflows/windows-2022.yml index efe5bc4fe0..91e5115739 100644 --- a/.github/workflows/windows-2022.yml +++ b/.github/workflows/windows-2022.yml @@ -20,6 +20,9 @@ jobs: pull-requests: read uses: ./.github/workflows/.dco.yml run: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc needs: validate-dco if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }} uses: ./.github/workflows/.windows.yml @@ -38,5 +41,3 @@ jobs: storage: ${{ matrix.storage }} containerd: ${{ matrix.containerd }} send_coverage: true - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/windows-2025.yml b/.github/workflows/windows-2025.yml index d2573a4e93..911b45cd41 100644 --- a/.github/workflows/windows-2025.yml +++ b/.github/workflows/windows-2025.yml @@ -25,6 +25,9 @@ jobs: uses: ./.github/workflows/.dco.yml run: + permissions: + contents: read + id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc needs: validate-dco if: ${{ github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'ci/validate-only') }} uses: ./.github/workflows/.windows.yml @@ -43,5 +46,3 @@ jobs: storage: ${{ matrix.storage }} containerd: ${{ matrix.containerd }} send_coverage: false - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}