Update coverage.yml to use OIDC for Codecov#8474
Conversation
Always prefer the tokenless method if available. There are no needs to use permanent token here for public repo. It supports verifying repo via OIDC.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 55e02f8fdc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| permissions: | ||
| id-token: write |
There was a problem hiding this comment.
When this job runs on push to master, adding a job-level permissions block with only id-token: write removes the previous GITHUB_TOKEN access for the later gh actions-cache delete step. GitHub's workflow syntax says unspecified permissions are set to none, and the Actions cache delete endpoint requires Actions repository permission write; without actions: write the delete is rejected (then hidden by || echo "not exist"), so the following actions/cache/save cannot refresh the master coverage cache under the same key.
Useful? React with 👍 / 👎.
rescript
@rescript/darwin-arm64
@rescript/darwin-x64
@rescript/linux-arm64
@rescript/linux-x64
@rescript/runtime
@rescript/win32-x64
commit: |
|
Developer playground preview: https://rescript-lang.github.io/rescript/dev-playground/?version=pr-8474 |
1 participant
Always prefer the tokenless method if available. There are no needs to use permanent token here for public repo. It supports verifying repo via OIDC.