codecov-action

Yeah, only works if all used Actions would use SHAs too, which is not the case. Positive example: https://github.com/codecov/codecov-action/blob/96b38e9e60ee6... Negative example: https://github.com/armbian/build/blob/54808ecff253fb71615161...

See https://about.codecov.io/blog/introducing-codecovs-new-uploader/ I'm just stumped by the stupidity of Codecov. Codecov's security breach involved someone gaining access to their repo, modifying the bash uploader script to -- apart from uploading code coverage reports -- also upload all (secret) environment variables set by the CI pipeline. This affected many people. Apart from discovering this months too late, their initial "mitigation" was to do checksum validation on the bash upload script. However, they failed to understand how that works, as they downloaded the checksum from the same URL the bash script was downloaded from. [1] Now they released a new "uploader" where the blog post mentions: > A compiled binary makes it more difficult for code to be modified by a middle man. which only proves their stupidity. Clearly you can repla

Looks like a PR [1] was started 4 hours ago but for such a simple task not much progress has been made. Security breaches happen. If it hasn't happened yet consider it luck. I'm disappointed by the lack of urgency in the response and failure to take nominal steps in improving their posture. I hope this is a wake up call for them and other Saas companies. [1]https://github.com/codecov/codecov-action/pull/282

do they mean that the Docker image at https://github.com/codecov/codecov-action contained a secret allowing someone to modify the script served by https://codecov.io/bash ?

Interesting that no hash/checksum verification has been added in their CI actions, like here, yet: https://github.com/codecov/codecov-action/blob/master/src/in...