Pull in bash script and bump to 1.5.0

[thomasrockhu]

Remove bash script curl dependency

• Removes SHASUM verification (the script has been checked)
• Removes request to codecov.io for the bash script
• Bumps to 1.5.0

[codecov]

Codecov Report

Merging #299 (2332a73) into master (31d2c8f) will increase coverage by 0.11%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #299      +/-   ##
==========================================
+ Coverage   97.02%   97.14%   +0.11%     
==========================================
  Files           4        3       -1     
  Lines         168      140      -28     
  Branches       47       43       -4     
==========================================
- Hits          163      136      -27     
+ Misses          5        4       -1     

Flag	Coverage Δ
demo	87.50% <ø> (ø)
script	98.38% <ø> (+0.36%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
src/buildExec.ts	98.38% <0.00%> (+0.80%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 31d2c8f...2332a73. Read the comment docs.

[briansmith]

I love this idea.

It does seem strange that two different copies of the codecov bash script have to be checked into the repo at once. git diff dist/codecov src/codecov && echo same shows they are exactly the same. If you could find a way to avoid this duplication then it would be easier for users to audit the action.

[thomasrockhu]

@briansmith yeah I noticed this at publishing time, and it definitely is a little strange. I'll work on making it more DRY and automated.

[recursivelycurious]

@thomasrockhu -- in light of the bash uploader security issue (https://about.codecov.io/security-update/), looking for a bit more detail on if this change set is related to / part of the remediation in any way?

Basically just trying to confirm if GitHub actions for uploading coverage results were impacted.

[thomasrockhu]

@recursivelycurious, this change set is in fact related and is part of the remediation. The Codecov Action for uploading coverage results was impacted. I would recommend reaching out to security@codecov.io for any specific questions.