Background
scripts/test-infra/verify.sh uploads coverage using the legacy Codecov bash uploader (https://uploader.codecov.io/latest/linux/codecov) and previously imported its PGP key from https://keybase.io/codecovsecurity/pgp_keys.asc.
Both are problematic:
- The Keybase PGP key URL now returns a 32-byte
SELF-SIGNED PUBLIC KEY NOT FOUND stub (Keybase shutdown), which broke verify-master for every PR (fixed as a stopgap by making the upload non-fatal — see the linked PR).
- The legacy uploader itself is deprecated by Codecov in favor of the Codecov CLI. It will eventually stop working entirely.
Proposal
Migrate the coverage upload in verify.sh to the supported Codecov CLI (cli.codecov.io), including its integrity-verification flow, while keeping the upload best-effort (non-gating). Validate it works in the Prow verify-master job (this is not a GitHub Actions context, so the codecov-action is not applicable).
Why separate
The immediate breakage was fixed minimally (make coverage upload non-fatal) to unblock merges. This modernization is a larger change with more review surface and is tracked here per one-concern-per-PR.
Background
scripts/test-infra/verify.shuploads coverage using the legacy Codecov bash uploader (https://uploader.codecov.io/latest/linux/codecov) and previously imported its PGP key fromhttps://keybase.io/codecovsecurity/pgp_keys.asc.Both are problematic:
SELF-SIGNED PUBLIC KEY NOT FOUNDstub (Keybase shutdown), which brokeverify-masterfor every PR (fixed as a stopgap by making the upload non-fatal — see the linked PR).Proposal
Migrate the coverage upload in
verify.shto the supported Codecov CLI (cli.codecov.io), including its integrity-verification flow, while keeping the upload best-effort (non-gating). Validate it works in the Prowverify-masterjob (this is not a GitHub Actions context, so thecodecov-actionis not applicable).Why separate
The immediate breakage was fixed minimally (make coverage upload non-fatal) to unblock merges. This modernization is a larger change with more review surface and is tracked here per one-concern-per-PR.