Use codecov-cli for uploads #85386
Conversation
ansibot
added
test
mattclay
removed
the
needs_triage
mattclay
force-pushed
the
codecov
branch
2 times, most recently
from
1d9195d to
b78aa67
Compare
ci_coverage ci_complete
|
|
||
| venv.create(venv_dir, with_pip=True) | ||
|
|
||
| run(python_bin, '-m', 'pip', 'install', f'{package}=={version}', '--disable-pip-version-check') |
There was a problem hiding this comment.
FTR, in #84818 I was hoping to replace the binary file hash checking with proper provenance verification. Do you think you could integrate that? This would require a separate pip download, followed by a pypi-attestations verify and only then pip install from the wheelhouse.
There was a problem hiding this comment.
The CI pipeline already performs many normal pip installs. Why do something different for this one?
There was a problem hiding this comment.
Actually, looking at this closer, this doesn't look like something should be integrating at all right now:
https://github.com/trailofbits/pypi-attestations/blob/main/README.md#usage-as-a-command-line-tool
The pypi-attestations CLI is intended primarily for experimentation, and is not considered a stable interface for generating or verifying attestations.
If there's anything to do with attestations, we should discuss that separately from the codecov changes.
There was a problem hiding this comment.
It's by the same people who added attestations to PyPI and wrote the PEP. I doubt the CLI will change in an incompatible way (there's also an importable API that might).
@mattclay the reason I wanted this is that Codecov's official GitHub action performs verification. At least for one of the installation variants. Though, they use their GPG keys and own web server serving binaries. They don't have an equivalent for pip install in there.
This originated back when they were hacked. And this was also why we opted to keep a copy of the binary we use on S3 back then, having checked it. Now that it's not under our control, this PR drops the provenance verification that was kinda there (though manual). So I wanted to keep some of that.
But I guess we could look into this aspect of supply chain separately.
ci_coverage ci_complete (cherry picked from commit 4a03ccb)
4 participants
SUMMARY
Use
codecov-clifor uploads.Resolves #84818.
ISSUE TYPE
Test Pull Request