"Server Error (500)" since codecov-action v4 update

[gdalle]

Describe the bug
On several of my repos (both personal and in organizations), whenever I try to update codecov-action to v4, I get a "Server Error (500)" during CI. This is of course after retrieving the Codecov token and storing it as a repo or organization secret (I actually wrote a guide on how to do this for the Julia community), so I don't think it's because of a bad setup on my end.

Environment (please complete the following information):

• Browser: Firefox but irrelevant
• System: GitHub Actions CI

To Reproduce
Steps to reproduce the behavior:
Example failed CI run at https://github.com/gdalle/DifferentiationInterface.jl/actions/runs/7826478656/job/21352421412?pr=18

Expected behavior
I expected the code coverage report to be uploaded and a comment to appear on the PR. Instead the CI fails.

Screenshots

Additional context
I thought this might be a temporary server error but:

• the codecov status page https://status.codecov.com/ is all green
• it happened both yesterday and today
• it happened on several of my repos (every one I've tried sofar)
• it didn't happen to some of my colleagues on other repos

[gdalle]

Related:

• v4 fails to upload: "Failed to properly create commit" codecov-action#1274 (comment)

[gdalle]

If anyone runs into this, I had made a mistake when entering the secret into GitHub: I had entered

CODECOV_TOKEN = abcd1234

instead of just

abcd1234

in the value box

[roflmaostc]

So funny, this happened to me too.
But it's also misleading in the settings of CodeCov.

I guess changing the display in the settings it would reduce mistakes

[gdalle]

Reopening because the error displayed shouldn't be a server error but some kind of authentification / token correctness error

And because the display is indeed misleading on the Codecov settings page: it should be made clear that the CODECOV_TOKEN= must not be copied

[drazisil-codecov]

@gdalle Can you copy over the SHA in plantext here? I will look into what is causing the 500

[drazisil-codecov]

Reopening because the error displayed shouldn't be a server error but some kind of authentification / token correctness error

And because the display is indeed misleading on the Codecov settings page: it should be made clear that the CODECOV_TOKEN= must not be copied

Feedback for Product on this, @codecovdesign

The current syntax is what would be added if this was being used locally in a console. Since you can always just pass the token as a flag in that case, I agree that we should change the instructions to read similar to:

Please create a repo secret with the name CODECOV_TOKEN. Set the value to your token of abcd1234. Then follow your CI provider's guide for adding the secret to your pipeline as an environment variable. (Please note that you can call the secret to any name you choose. When following these instructions, if you do change the secret name, make sure to use the new name when passing the secret to your CI pipeline.

[gdalle]

@gdalle Can you copy over the SHA in plantext here? I will look into what is causing the 500

==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit -C 31524d2205280ac289a3e75dfe7169a72472c330 -Z
==> Uploader SHASUM verified (103bfefcc56f76473179e600b96eb8150b0f349ad94836b0f63f03ffac469ad7  codecov)

You can find all the plain text info here: https://github.com/gdalle/DifferentiationInterface.jl/actions/runs/7826478656/job/21352421412?pr=18

[gdalle]

The current syntax is what would be added if this was being used locally in a console. Since you can always just pass the token as a flag in that case, I agree that we should change the instructions to read similar to:

What's also misguiding is that the copy-paste buttons just takes the whole thing and not just the secret value

[drazisil-codecov]

@gdalle Can you copy over the SHA in plantext here? I will look into what is causing the 500

==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit -C 31524d2205280ac289a3e75dfe7169a72472c330 -Z
==> Uploader SHASUM verified (103bfefcc56f76473179e600b96eb8150b0f349ad94836b0f63f03ffac469ad7  codecov)

You can find all the plain text info here: https://github.com/gdalle/DifferentiationInterface.jl/actions/runs/7826478656/job/21352421412?pr=18

Based on my error logs, I think it might be https://github.com/codecov/internal-issues/issues/329

Do you have the GitHub app installed?

edit: fixed issue link

[gdalle]

I do have the GitHub app on my phone, why?

[drazisil-codecov]

I do have the GitHub app on my phone, why?

This app, sorry for being unclear https://github.com/apps/codecov

[gdalle]

No it's not installed on my repos, and it used to work fine that way. It also works fine now that I have understood what to copy-paste in the CODECOV_TOKEN GitHub secret field

[thomasrockhu-codecov]

Closing as the original 500 issue has been resolved.