Alpine image not auto-detected on Action #1262

mvorisek · 2024-02-03T14:14:59Z

CI log:

1s
Run codecov/codecov-action@v4
  with:
    token: ***
    fail_ci_if_error: true
    files: coverage/merged.xml,coverage/js/clover.xml
  env:
    LOG_COVERAGE: 1
/usr/bin/docker exec  fd8d6bfcab9afaaaefd7cb1c23b43d13cb5c46fd29b243c01cf76d86136bb29f sh -c "cat /etc/*release | grep ^ID"
==> linux OS detected
https://cli.codecov.io/latest/linux/codecov.SHA256SUM
==> Running version latest
gpg: directory '/github/home/.gnupg' created
gpg: /github/home/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1

gpg: Signature made Fri Feb  2 14:15:33 2024 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869

==> Running version v0.4.6
==> Running command '/__w/_actions/codecov/codecov-action/v4/dist/codecov create-commit'
/__w/_actions/codecov/codecov-action/v4/dist/codecov create-commit -C 864df81d007f7cd8a0fea2e9495d14fd4563f03e -Z
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __strcat_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __snprintf_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __vfprintf_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __realpath_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __strdup: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __memcpy_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __vsnprintf_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __strcpy_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __fread_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __fprintf_chk: symbol not found

v3 with the same config is passing without any issue, but we want to upgrade as Node 16 is deprecated.

The text was updated successfully, but these errors were encountered:

thomasrockhu-codecov · 2024-02-06T01:31:24Z

@mvorisek yeah I noticed this. I'm not sure why there's a difference between running gpgv versus gpg -v for this which would NOT show this warning, but there is this issue. I have confirmed with our security team that the security key is in fact correct and the warning is not showing something malicious.

I will continue to look into this so that the warning is properly removed.

codecov/codecov-action#1262

mvorisek · 2024-02-15T08:33:04Z

Here https://github.com/atk4/core/blob/63a2d72bbf/.github/workflows/test-unit.yml#L135 is a repro if it helps. Also notice, we use custom Alpine container image https://github.com/atk4/core/blob/63a2d72bbf/.github/workflows/test-unit.yml#L14.

Based on the likes it seems many people are affected.

The solution should be probably https://superuser.com/questions/1435147/how-to-suppress-warning-this-key-is-not-certified-with-a-trusted-signature#1435150, ie. gpg --lsign-key "xxx" as mentioned also in https://serverfault.com/questions/569911/how-to-verify-an-imported-gpg-key#1150984

mvorisek · 2024-03-04T20:23:07Z

@thomasrockhu-codecov is there any progress on this issue?

thomasrockhu-codecov · 2024-03-07T02:48:32Z

@mvorisek I've been digging into this for a bit now. I don't think that adding gpg --lsign-key is what should be done.

The warning message implies that the key has not been signed by the user

it likely means we haven't signed the public key of the signature-maker.

This means that you, the user, have not indicated you trust the key. As a result, unless you actually import the key and sign it yourself, we will not be able to do anything about the warning.

As it is, the warning is just that, a warning, as the key is hard coded into the codebase.

mvorisek · 2024-03-07T10:18:27Z

@thomasrockhu-codecov please kindly reopen this issue, we use fail_ci_if_error: true and it currently fails our CI - so it is not a warning, it is an error which prevents us to upgrade to v4 (introduced in #1218).

thomasrockhu-codecov · 2024-03-07T17:55:49Z

@mvorisek oh! sorry I didn't realize that would happen. Let me dig in a little more then.

thomasrockhu-codecov · 2024-03-07T21:51:25Z

@mvorisek I don't think this is related to trusted signature as the system gets past verification. What is curious are the log lines after create-commit. Doing a quick search shows this could be related to glibc (see this issue).

mvorisek · 2024-03-08T16:16:13Z

@mvorisek I don't think this is related to trusted signature as the system gets past verification. What is curious are the log lines after create-commit. Doing a quick search shows this could be related to glibc (see this issue).

👍

here is a minimal repro using GH Actions:

on:
  push:

jobs:
  ci:
    container:
      image: alpine
    steps:
      - name: Store coverage
        run: |
          # store coverage/merged.xml file here

      - name: Upload coverage logs
        uses: codecov/codecov-action@v4
        with:
          token: ${{ secrets.CODECOV_TOKEN }}
          fail_ci_if_error: true
          files: coverage/merged.xml

with local Docker and alpine base image should should be simple to reproduce the issue.

Does Codecov bundle some lib linked againts glibc? I use Alpine quite a lot and I would be surprised if native Alpine git lib would be this broken.

drazisil-codecov · 2024-03-08T18:45:46Z

Alpine doesn't use glibc, it uses musl, which is not the same. Could be that.

mvorisek · 2024-03-08T18:54:04Z

Yes. My concern is what package causes that issue, dist/codecov? Is that some precompiled codecov binary?

drazisil-codecov · 2024-03-08T18:58:18Z

action@v4 uses https://github.com/codecov/codecov-cli.

Specifically,

codecov-action/src/helpers.ts

Lines 54 to 56 in 8be6ba5

    
           const getBaseUrl = (platform: string, version: string): string => { 
        
             return `https://cli.codecov.io/${version}/${platform}/${getUploaderName(platform)}`; 
        
           };

I think we use pyinstaller.

psychobolt · 2024-04-04T02:47:17Z

Works now on c16abc2

- use: codecov/codecov-action@c16abc29c95fcf9174b58eb7e1abf4c866893bc8 # 4.1.1
  # ...

hellwolf · 2024-04-08T22:24:12Z

ours fails after upgrading to 4.2.0 https://github.com/superfluid-finance/protocol-monorepo/actions/runs/8606474561/job/23586919598

(we were upgrading it to fix the previous failure.)

Frustratingly, we can't find a config now that works.

mvorisek · 2024-04-08T22:29:39Z

We had to stick to v3 which uses deprecated Node 18.

Someone from Codecov should look into it as it affects a lot of users based on the votes count and the fact Alpine is very popular. The repro should be easy, use this plugin on Github workflow using alpine:latest image.

thomasrockhu-codecov · 2024-05-14T16:53:11Z

@mvorisek I have made an underlying change to the action and in setting fail_ci_if_error to true should not break. Would you mind trying the latest v4 and seeing if this works for you.

mvorisek · 2024-05-15T09:59:58Z

Unfortunately, there is still some issue: https://github.com/atk4/core/actions/runs/9093675020/job/24993133255?pr=411#step:11:30.

thomasrockhu-codecov · 2024-05-15T14:25:42Z

@mvorisek ahhh, this is a different issue. what OS is your runner using? You may need to specify a different OS for the action

  with:
    token: ***
    fail_ci_if_error: true
    files: coverage/merged.xml
    os: alpine

mvorisek · 2024-05-15T15:04:56Z

I am running on Alpine. If there needs to be some different binary uploaded, I belive the detection should be done on runtime by the GH action itself.

thomasrockhu-codecov · 2024-05-15T15:59:09Z

@mvorisek you are correct, I have that on my list of things to do, but for now I just wanted you unblocked

gVg771 · 2024-07-09T18:14:04Z

CI log:

1s
Run codecov/codecov-action@v4
  with:
    token: ***
    fail_ci_if_error: true
    files: coverage/merged.xml,coverage/js/clover.xml
  env:
    LOG_COVERAGE: 1
/usr/bin/docker exec  fd8d6bfcab9afaaaefd7cb1c23b43d13cb5c46fd29b243c01cf76d86136bb29f sh -c "cat /etc/*release | grep ^ID"
==> linux OS detected
https://cli.codecov.io/latest/linux/codecov.SHA256SUM
==> Running version latest
gpg: directory '/github/home/.gnupg' created
gpg: /github/home/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1

gpg: Signature made Fri Feb  2 14:15:33 2024 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869

==> Running version v0.4.6
==> Running command '/__w/_actions/codecov/codecov-action/v4/dist/codecov create-commit'
/__w/_actions/codecov/codecov-action/v4/dist/codecov create-commit -C 864df81d007f7cd8a0fea2e9495d14fd4563f03e -Z
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __strcat_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __snprintf_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __vfprintf_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __realpath_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __strdup: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __memcpy_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __vsnprintf_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __strcpy_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __fread_chk: symbol not found
Error relocating /__w/_actions/codecov/codecov-action/v4/dist/codecov: __fprintf_chk: symbol not found

v3 with the same config is passing without any issue, but we want to upgrade as Node 16 is deprecated.

See codecov/codecov-action#1262

mvorisek mentioned this issue Feb 3, 2024

Fix deprecated Node 16 in CI atk4/ui#2157

Draft

thomasrockhu-codecov self-assigned this Feb 5, 2024

rohan-at-sentry mentioned this issue Feb 8, 2024

[v4] Failing to import PGP key when updating from v3 to v4 #1279

Closed

HerringtonDarkholme added a commit to ast-grep/ast-grep that referenced this issue Feb 10, 2024

fix: revert codecov v4

4ea9c6b

codecov/codecov-action#1262

igrek8 mentioned this issue Feb 11, 2024

Revert "build(deps): bump codecov/codecov-action from 3 to 4" igrek8/github-workflows#16

Merged

ryshu mentioned this issue Feb 26, 2024

ALPHA: Next release novuhq/novu-python#187

Merged

thomasrockhu-codecov closed this as completed Mar 7, 2024

thomasrockhu-codecov reopened this Mar 7, 2024

ktbarrett mentioned this issue Mar 11, 2024

Missing coverage upload ktbarrett/find_libpython#48

Open

nateprewitt mentioned this issue Mar 13, 2024

Bump codecov/codecov-action from 3 to 4 smithy-lang/smithy-python#203

Open

thomasrockhu-codecov removed their assignment Mar 14, 2024

psychobolt mentioned this issue Mar 20, 2024

Update codecov/codecov-action action to v4 (main) psychobolt/vite-storybook-boilerplate#568

Merged

1 task

hellwolf mentioned this issue Apr 8, 2024

[subgraph][spike] deploy protocol subgraphs to Goldsky superfluid-finance/protocol-monorepo#1918

Merged

thomasrockhu-codecov added support bug Something isn't working labels May 14, 2024

thomasrockhu-codecov self-assigned this May 14, 2024

thomasrockhu-codecov changed the title ~~[v4] This key is not certified with a trusted signature!~~ Alpine image not auto-detected on Action May 16, 2024

mtrezza mentioned this issue May 16, 2024

Codecov not working parse-community/parse-server#9129

Open

Zharktas mentioned this issue Jun 17, 2024

Undocumented dependencies of v4 while running in a container #1482

Open

xingxing789 mentioned this issue Jun 17, 2024

CI log: trustwallet/assets#28519

Closed

sebhmg added a commit to sebhmg/param-sweeps that referenced this issue Jul 12, 2024

attempt to fix Codecov action by forcing OS

a4c09d8

See codecov/codecov-action#1262

robcxyz added a commit to sudoblockio/icon-governance that referenced this issue Aug 1, 2024

chore: snub codecov codecov/codecov-action/issues/1262

0911538

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Alpine image not auto-detected on Action #1262

Alpine image not auto-detected on Action #1262

mvorisek commented Feb 3, 2024

thomasrockhu-codecov commented Feb 6, 2024

mvorisek commented Feb 15, 2024

mvorisek commented Mar 4, 2024

thomasrockhu-codecov commented Mar 7, 2024

mvorisek commented Mar 7, 2024 •

edited

Loading

thomasrockhu-codecov commented Mar 7, 2024

thomasrockhu-codecov commented Mar 7, 2024

mvorisek commented Mar 8, 2024

drazisil-codecov commented Mar 8, 2024

mvorisek commented Mar 8, 2024

drazisil-codecov commented Mar 8, 2024 •

edited

Loading

psychobolt commented Apr 4, 2024 •

edited

Loading

hellwolf commented Apr 8, 2024

mvorisek commented Apr 8, 2024

thomasrockhu-codecov commented May 14, 2024

mvorisek commented May 15, 2024

thomasrockhu-codecov commented May 15, 2024

mvorisek commented May 15, 2024

thomasrockhu-codecov commented May 15, 2024

gVg771 commented Jul 9, 2024

Alpine image not auto-detected on Action #1262

Alpine image not auto-detected on Action #1262

Comments

mvorisek commented Feb 3, 2024

thomasrockhu-codecov commented Feb 6, 2024

mvorisek commented Feb 15, 2024

mvorisek commented Mar 4, 2024

thomasrockhu-codecov commented Mar 7, 2024

mvorisek commented Mar 7, 2024 • edited Loading

thomasrockhu-codecov commented Mar 7, 2024

thomasrockhu-codecov commented Mar 7, 2024

mvorisek commented Mar 8, 2024

drazisil-codecov commented Mar 8, 2024

mvorisek commented Mar 8, 2024

drazisil-codecov commented Mar 8, 2024 • edited Loading

psychobolt commented Apr 4, 2024 • edited Loading

hellwolf commented Apr 8, 2024

mvorisek commented Apr 8, 2024

thomasrockhu-codecov commented May 14, 2024

mvorisek commented May 15, 2024

thomasrockhu-codecov commented May 15, 2024

mvorisek commented May 15, 2024

thomasrockhu-codecov commented May 15, 2024

gVg771 commented Jul 9, 2024

mvorisek commented Mar 7, 2024 •

edited

Loading

drazisil-codecov commented Mar 8, 2024 •

edited

Loading

psychobolt commented Apr 4, 2024 •

edited

Loading