codecov · thomasrockhu-codecov · Aug 19, 2025 · Aug 19, 2025
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,17 @@
+## v5.5.0
+
+### What's Changed
+* feat: upgrade wrapper to 0.2.4 by @jviall in https://github.com/codecov/codecov-action/pull/1864
+* Pin actions/github-script by Git SHA by @martincostello in https://github.com/codecov/codecov-action/pull/1859
+* fix: check reqs exist by @joseph-sentry in https://github.com/codecov/codecov-action/pull/1835
+* fix: Typo in README by @spalmurray in https://github.com/codecov/codecov-action/pull/1838
+* docs: Refine OIDC docs by @spalmurray in https://github.com/codecov/codecov-action/pull/1837
+* build(deps): bump github/codeql-action from 3.28.17 to 3.28.18 by @app/dependabot in https://github.com/codecov/codecov-action/pull/1829
+
+
+**Full Changelog**: https://github.com/codecov/codecov-action/compare/v5.4.3..v5.5.0
+
+
 ## v5.4.3
 
 ### What's Changed

diff --git a/dist/codecov.sh b/dist/codecov.sh
@@ -37,10 +37,11 @@ g="\033[0;32m"  # info/debug
 r="\033[0;31m"  # errors
 x="\033[0m"
 retry="--retry 5 --retry-delay 2"
-CC_WRAPPER_VERSION="0.2.4"
+CC_WRAPPER_VERSION="0.2.7"
 CC_VERSION="${CC_VERSION:-latest}"
 CC_FAIL_ON_ERROR="${CC_FAIL_ON_ERROR:-false}"
 CC_RUN_CMD="${CC_RUN_CMD:-upload-coverage}"
+CC_CLI_TYPE=${CC_CLI_TYPE:-"codecov-cli"}
 say "     _____          _
     / ____|        | |
    | |     ___   __| | ___  ___ _____   __
@@ -49,22 +50,26 @@ say "     _____          _
     \\_____\\___/ \\__,_|\\___|\\___\\___/ \\_/
                            $r Wrapper-$CC_WRAPPER_VERSION$x
                            "
+if [[ "$CC_CLI_TYPE" != "codecov-cli" && "$CC_CLI_TYPE" != "sentry-prevent-cli" ]]; then
+  echo "Invalid CC_CLI_TYPE: '$CC_CLI_TYPE'. Must be 'codecov-cli' or 'sentry-prevent-cli'"
+  exit 1
+fi
 if [ -n "$CC_BINARY" ];
 then
   if [ -f "$CC_BINARY" ];
   then
-    c_filename=$CC_BINARY
-    c_command=$CC_BINARY
+    CC_FILENAME=$CC_BINARY
+    CC_COMMAND=$CC_BINARY
   else
     exit_if_error "Could not find binary file $CC_BINARY"
   fi
 elif [ "$CC_USE_PYPI" == "true" ];
 then
-  if ! pip install codecov-cli"$([ "$CC_VERSION" == "latest" ] && echo "" || echo "==$CC_VERSION" )"; then
+  if ! pip install "${CC_CLI_TYPE}$([ "$CC_VERSION" == "latest" ] && echo "" || echo "==$CC_VERSION")"; then
     exit_if_error "Could not install via pypi."
     exit
   fi
-  c_command="codecovcli"
+  CC_COMMAND="${CC_CLI_TYPE}"
 else
   if [ -n "$CC_OS" ];
   then
@@ -80,17 +85,17 @@ else
     [[ $(arch) == "aarch64" && $family == "linux" ]] && CC_OS+="-arm64"
     say "$g==>$x Detected $b${CC_OS}$x"
   fi
-  c_filename="codecov"
-  [[ $CC_OS == "windows" ]] && c_filename+=".exe"
-  c_command="./$c_filename"
+  CC_FILENAME="${CC_CLI_TYPE%-cli}"
+  [[ $CC_OS == "windows" ]] && CC_FILENAME+=".exe"
+  CC_COMMAND="./$CC_FILENAME"
   [[ $CC_OS == "macos" ]]  && \
     ! command -v gpg 2>&1 >/dev/null && \
     HOMEBREW_NO_AUTO_UPDATE=1 brew install gpg
-  c_url="${CC_CLI_URL:-https://cli.codecov.io}"
-  c_url="$c_url/${CC_VERSION}"
-  c_url="$c_url/${CC_OS}/${c_filename}"
-  say "$g ->$x Downloading $b${c_url}$x"
-  curl -O $retry "$c_url"
+  CC_URL="${CC_CLI_URL:-https://cli.codecov.io}"
+  CC_URL="$CC_URL/${CC_VERSION}"
+  CC_URL="$CC_URL/${CC_OS}/${CC_FILENAME}"
+  say "$g ->$x Downloading $b${CC_URL}$x"
+  curl -O $retry "$CC_URL"
   say "$g==>$x Finishing downloading $b${CC_OS}:${CC_VERSION}$x"
   v_url="https://cli.codecov.io/api/${CC_OS}/${CC_VERSION}"
   v=$(curl $retry --retry-all-errors -s "$v_url" -H "Accept:application/json" | tr \{ '\n' | tr , '\n' | tr \} '\n' | grep "\"version\"" | awk  -F'"' '{print $4}' | tail -1)
@@ -100,161 +105,165 @@ fi
 if [ "$CC_SKIP_VALIDATION" == "true" ] || [ -n "$CC_BINARY" ] || [ "$CC_USE_PYPI" == "true" ];
 then
   say "$r==>$x Bypassing validation..."
+  if [ "$CC_SKIP_VALIDATION" == "true" ];
+  then
+    chmod +x "$CC_COMMAND"
+  fi
 else
-  CC_PUBLIC_PGP_KEY=$(curl -s https://keybase.io/codecovsecurity/pgp_keys.asc)
-  echo "${CC_PUBLIC_PGP_KEY}"  | \
+  echo "$(curl -s https://keybase.io/codecovsecurity/pgp_keys.asc)" | \
     gpg --no-default-keyring --import
   # One-time step
   say "$g==>$x Verifying GPG signature integrity"
   sha_url="https://cli.codecov.io"
   sha_url="${sha_url}/${CC_VERSION}/${CC_OS}"
-  sha_url="${sha_url}/${c_filename}.SHA256SUM"
+  sha_url="${sha_url}/${CC_FILENAME}.SHA256SUM"
   say "$g ->$x Downloading $b${sha_url}$x"
   say "$g ->$x Downloading $b${sha_url}.sig$x"
   say " "
   curl -Os $retry --connect-timeout 2 "$sha_url"
   curl -Os $retry --connect-timeout 2 "${sha_url}.sig"
-  if ! gpg --verify "${c_filename}.SHA256SUM.sig" "${c_filename}.SHA256SUM";
+  if ! gpg --verify "${CC_FILENAME}.SHA256SUM.sig" "${CC_FILENAME}.SHA256SUM";
   then
     exit_if_error "Could not verify signature. Please contact Codecov if problem continues"
   fi
-  if ! (shasum -a 256 -c "${c_filename}.SHA256SUM" 2>/dev/null || \
-    sha256sum -c "${c_filename}.SHA256SUM");
+  if ! (shasum -a 256 -c "${CC_FILENAME}.SHA256SUM" 2>/dev/null || \
+    sha256sum -c "${CC_FILENAME}.SHA256SUM");
   then
     exit_if_error "Could not verify SHASUM. Please contact Codecov if problem continues"
   fi
   say "$g==>$x CLI integrity verified"
   say
-  chmod +x "$c_command"
+  chmod +x "$CC_COMMAND"
 fi
 if [ -n "$CC_BINARY_LOCATION" ];
 then
-  mkdir -p "$CC_BINARY_LOCATION" && mv "$c_filename" $_
-  say "$g==>$x Codecov binary moved to ${CC_BINARY_LOCATION}"
+  mkdir -p "$CC_BINARY_LOCATION" && mv "$CC_FILENAME" $_
+  say "$g==>$x ${CC_CLI_TYPE} binary moved to ${CC_BINARY_LOCATION}"
 fi
 if [ "$CC_DOWNLOAD_ONLY" = "true" ];
 then
-  say "$g==>$x Codecov download only called. Exiting..."
+  say "$g==>$x ${CC_CLI_TYPE} download only called. Exiting..."
+  exit
 fi
-c_cli_args=()
-c_cli_args+=( $(k_arg AUTO_LOAD_PARAMS_FROM) $(v_arg AUTO_LOAD_PARAMS_FROM))
-c_cli_args+=( $(k_arg ENTERPRISE_URL) $(v_arg ENTERPRISE_URL))
+CC_CLI_ARGS=()
+CC_CLI_ARGS+=( $(k_arg AUTO_LOAD_PARAMS_FROM) $(v_arg AUTO_LOAD_PARAMS_FROM))
+CC_CLI_ARGS+=( $(k_arg ENTERPRISE_URL) $(v_arg ENTERPRISE_URL))
 if [ -n "$CC_YML_PATH" ]
 then
-  c_cli_args+=( "--codecov-yml-path" )
-  c_cli_args+=( "$CC_YML_PATH" )
-fi
-c_cli_args+=( $(write_bool_args CC_DISABLE_TELEM) )
-c_cli_args+=( $(write_bool_args CC_VERBOSE) )
-if [ -n "$CC_TOKEN_VAR" ];
-then
-  token="$(eval echo \$$CC_TOKEN_VAR)"
-else
-  token="$(eval echo $CC_TOKEN)"
-fi
-say "$g ->$x Token length: ${#token}"
-token_str=""
-token_arg=()
-if [ -n "$token" ];
-then
-  token_str+=" -t <redacted>"
-  token_arg+=( " -t " "$token")
+  CC_CLI_ARGS+=( "--codecov-yml-path" )
+  CC_CLI_ARGS+=( "$CC_YML_PATH" )
 fi
-c_args=()
+CC_CLI_ARGS+=( $(write_bool_args CC_DISABLE_TELEM) )
+CC_CLI_ARGS+=( $(write_bool_args CC_VERBOSE) )
+CC_ARGS=()
 if [ "$CC_RUN_CMD" == "upload-coverage" ]; then
 # Args for create commit
-c_args+=( $(write_bool_args CC_FAIL_ON_ERROR) )
-c_args+=( $(k_arg GIT_SERVICE) $(v_arg GIT_SERVICE))
-c_args+=( $(k_arg PARENT_SHA) $(v_arg PARENT_SHA))
-c_args+=( $(k_arg PR) $(v_arg PR))
-c_args+=( $(k_arg SHA) $(v_arg SHA))
-c_args+=( $(k_arg SLUG) $(v_arg SLUG))
+CC_ARGS+=( $(write_bool_args CC_FAIL_ON_ERROR) )
+CC_ARGS+=( $(k_arg GIT_SERVICE) $(v_arg GIT_SERVICE))
+CC_ARGS+=( $(k_arg PARENT_SHA) $(v_arg PARENT_SHA))
+CC_ARGS+=( $(k_arg PR) $(v_arg PR))
+CC_ARGS+=( $(k_arg SHA) $(v_arg SHA))
+CC_ARGS+=( $(k_arg SLUG) $(v_arg SLUG))
 # Args for create report
-c_args+=( $(k_arg CODE) $(v_arg CODE))
+CC_ARGS+=( $(k_arg CODE) $(v_arg CODE))
 # Args for do upload
-c_args+=( $(k_arg ENV) $(v_arg ENV))
+CC_ARGS+=( $(k_arg ENV) $(v_arg ENV))
 OLDIFS=$IFS;IFS=,
-c_args+=( $(k_arg BRANCH) $(v_arg BRANCH))
-c_args+=( $(k_arg BUILD) $(v_arg BUILD))
-c_args+=( $(k_arg BUILD_URL) $(v_arg BUILD_URL))
-c_args+=( $(k_arg DIR) $(v_arg DIR))
-c_args+=( $(write_bool_args CC_DISABLE_FILE_FIXES) )
-c_args+=( $(write_bool_args CC_DISABLE_SEARCH) )
-c_args+=( $(write_bool_args CC_DRY_RUN) )
+CC_ARGS+=( $(k_arg BRANCH) $(v_arg BRANCH))
+CC_ARGS+=( $(k_arg BUILD) $(v_arg BUILD))
+CC_ARGS+=( $(k_arg BUILD_URL) $(v_arg BUILD_URL))
+CC_ARGS+=( $(k_arg DIR) $(v_arg DIR))
+CC_ARGS+=( $(write_bool_args CC_DISABLE_FILE_FIXES) )
+CC_ARGS+=( $(write_bool_args CC_DISABLE_SEARCH) )
+CC_ARGS+=( $(write_bool_args CC_DRY_RUN) )
 if [ -n "$CC_EXCLUDES" ];
 then
   for directory in $CC_EXCLUDES; do
-    c_args+=( "--exclude" "$directory" )
+    CC_ARGS+=( "--exclude" "$directory" )
   done
 fi
 if [ -n "$CC_FILES" ];
 then
   for file in $CC_FILES; do
-    c_args+=( "--file" "$file" )
+    CC_ARGS+=( "--file" "$file" )
   done
 fi
 if [ -n "$CC_FLAGS" ];
 then
   for flag in $CC_FLAGS; do
-    c_args+=( "--flag" "$flag" )
+    CC_ARGS+=( "--flag" "$flag" )
   done
 fi
-c_args+=( $(k_arg GCOV_ARGS) $(v_arg GCOV_ARGS))
-c_args+=( $(k_arg GCOV_EXECUTABLE) $(v_arg GCOV_EXECUTABLE))
-c_args+=( $(k_arg GCOV_IGNORE) $(v_arg GCOV_IGNORE))
-c_args+=( $(k_arg GCOV_INCLUDE) $(v_arg GCOV_INCLUDE))
-c_args+=( $(write_bool_args CC_HANDLE_NO_REPORTS_FOUND) )
-c_args+=( $(write_bool_args CC_RECURSE_SUBMODULES) )
-c_args+=( $(k_arg JOB_CODE) $(v_arg JOB_CODE))
-c_args+=( $(write_bool_args CC_LEGACY) )
+CC_ARGS+=( $(k_arg GCOV_ARGS) $(v_arg GCOV_ARGS))
+CC_ARGS+=( $(k_arg GCOV_EXECUTABLE) $(v_arg GCOV_EXECUTABLE))
+CC_ARGS+=( $(k_arg GCOV_IGNORE) $(v_arg GCOV_IGNORE))
+CC_ARGS+=( $(k_arg GCOV_INCLUDE) $(v_arg GCOV_INCLUDE))
+CC_ARGS+=( $(write_bool_args CC_HANDLE_NO_REPORTS_FOUND) )
+CC_ARGS+=( $(write_bool_args CC_RECURSE_SUBMODULES) )
+CC_ARGS+=( $(k_arg JOB_CODE) $(v_arg JOB_CODE))
+CC_ARGS+=( $(write_bool_args CC_LEGACY) )
 if [ -n "$CC_NAME" ];
 then
-  c_args+=( "--name" "$CC_NAME" )
+  CC_ARGS+=( "--name" "$CC_NAME" )
 fi
-c_args+=( $(k_arg NETWORK_FILTER) $(v_arg NETWORK_FILTER))
-c_args+=( $(k_arg NETWORK_PREFIX) $(v_arg NETWORK_PREFIX))
-c_args+=( $(k_arg NETWORK_ROOT_FOLDER) $(v_arg NETWORK_ROOT_FOLDER))
+CC_ARGS+=( $(k_arg NETWORK_FILTER) $(v_arg NETWORK_FILTER))
+CC_ARGS+=( $(k_arg NETWORK_PREFIX) $(v_arg NETWORK_PREFIX))
+CC_ARGS+=( $(k_arg NETWORK_ROOT_FOLDER) $(v_arg NETWORK_ROOT_FOLDER))
 if [ -n "$CC_PLUGINS" ];
 then
   for plugin in $CC_PLUGINS; do
-    c_args+=( "--plugin" "$plugin" )
+    CC_ARGS+=( "--plugin" "$plugin" )
   done
 fi
-c_args+=( $(k_arg REPORT_TYPE) $(v_arg REPORT_TYPE))
-c_args+=( $(k_arg SWIFT_PROJECT) $(v_arg SWIFT_PROJECT))
+CC_ARGS+=( $(k_arg REPORT_TYPE) $(v_arg REPORT_TYPE))
+CC_ARGS+=( $(k_arg SWIFT_PROJECT) $(v_arg SWIFT_PROJECT))
 IFS=$OLDIFS
 elif [ "$CC_RUN_CMD" == "empty-upload" ]; then
-c_args+=( $(k_arg BRANCH) $(v_arg BRANCH))
-c_args+=( $(write_bool_args CC_FAIL_ON_ERROR) )
-c_args+=( $(write_bool_args CC_FORCE) )
-c_args+=( $(k_arg GIT_SERVICE) $(v_arg GIT_SERVICE))
-c_args+=( $(k_arg PARENT_SHA) $(v_arg PARENT_SHA))
-c_args+=( $(k_arg PR) $(v_arg PR))
-c_args+=( $(k_arg SHA) $(v_arg SHA))
-c_args+=( $(k_arg SLUG) $(v_arg SLUG))
+CC_ARGS+=( $(k_arg BRANCH) $(v_arg BRANCH))
+CC_ARGS+=( $(write_bool_args CC_FAIL_ON_ERROR) )
+CC_ARGS+=( $(write_bool_args CC_FORCE) )
+CC_ARGS+=( $(k_arg GIT_SERVICE) $(v_arg GIT_SERVICE))
+CC_ARGS+=( $(k_arg PARENT_SHA) $(v_arg PARENT_SHA))
+CC_ARGS+=( $(k_arg PR) $(v_arg PR))
+CC_ARGS+=( $(k_arg SHA) $(v_arg SHA))
+CC_ARGS+=( $(k_arg SLUG) $(v_arg SLUG))
 elif [ "$CC_RUN_CMD" == "pr-base-picking" ]; then
-c_args+=( $(k_arg BASE_SHA) $(v_arg BASE_SHA))
-c_args+=( $(k_arg PR) $(v_arg PR))
-c_args+=( $(k_arg SLUG) $(v_arg SLUG))
-c_args+=( $(k_arg SERVICE) $(v_arg SERVICE))
+CC_ARGS+=( $(k_arg BASE_SHA) $(v_arg BASE_SHA))
+CC_ARGS+=( $(k_arg PR) $(v_arg PR))
+CC_ARGS+=( $(k_arg SLUG) $(v_arg SLUG))
+CC_ARGS+=( $(k_arg SERVICE) $(v_arg SERVICE))
 elif [ "$CC_RUN_CMD" == "send-notifications" ]; then
-c_args+=( $(k_arg SHA) $(v_arg SHA))
-c_args+=( $(write_bool_args CC_FAIL_ON_ERROR) )
-c_args+=( $(k_arg GIT_SERVICE) $(v_arg GIT_SERVICE))
-c_args+=( $(k_arg SLUG) $(v_arg SLUG))
+CC_ARGS+=( $(k_arg SHA) $(v_arg SHA))
+CC_ARGS+=( $(write_bool_args CC_FAIL_ON_ERROR) )
+CC_ARGS+=( $(k_arg GIT_SERVICE) $(v_arg GIT_SERVICE))
+CC_ARGS+=( $(k_arg SLUG) $(v_arg SLUG))
 else
   exit_if_error "Invalid run command specified: $CC_RUN_CMD"
   exit
 fi
 unset NODE_OPTIONS
 # github.com/codecov/uploader/issues/475
+if [ -n "$CC_TOKEN_VAR" ];
+then
+  token="$(eval echo \$$CC_TOKEN_VAR)"
+else
+  token="$(eval echo $CC_TOKEN)"
+fi
+say "$g ->$x Token length: ${#token}"
+token_str=""
+token_arg=()
+if [ -n "$token" ];
+then
+  token_str+=" -t <redacted>"
+  token_arg+=( " -t " "$token")
+fi
 say "$g==>$x Running $CC_RUN_CMD"
-say "      $b$c_command $(echo "${c_cli_args[@]}") $CC_RUN_CMD$token_str $(echo "${c_args[@]}")$x"
-if ! $c_command \
-  ${c_cli_args[*]} \
+say "      $b$CC_COMMAND $(echo "${CC_CLI_ARGS[@]}") $CC_RUN_CMD$token_str $(echo "${CC_ARGS[@]}")$x"
+if ! $CC_COMMAND \
+  ${CC_CLI_ARGS[*]} \
   ${CC_RUN_CMD} \
   ${token_arg[*]} \
-  "${c_args[@]}";
+  "${CC_ARGS[@]}";
 then
   exit_if_error "Failed to run $CC_RUN_CMD"
 fi
diff --git a/src/scripts b/src/scripts
diff --git a/src/version b/src/version
@@ -1 +1 @@
-5.4.3
+5.5.0
+107 −98		dist/codecov.sh
+0 −29		env
+2 −1		package.py
+12 −12		scripts/download.sh
+19 −4		scripts/run_command.sh
+8 −23		scripts/set_args.sh
+7 −1		scripts/set_defaults.sh
+8 −8		scripts/set_empty_upload_args.sh
+4 −4		scripts/set_pr_base_picking_args.sh
+4 −4		scripts/set_send_notifications_args.sh
+0 −17		scripts/set_token.sh
+33 −33		scripts/set_upload_coverage_args.sh
+0 −1		scripts/set_validation_key.sh
+14 −10		scripts/validate.sh