Skip to content

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Oct 10, 2025

Bumps codecov/codecov-action from 4 to 5.

Release notes

Sourced from codecov/codecov-action's releases.

v5.0.0

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING]
The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Changelog

Sourced from codecov/codecov-action's changelog.

v5 Release

v5 of the Codecov GitHub Action will use the Codecov Wrapper to encapsulate the CLI. This will help ensure that the Action gets updates quicker.

Migration Guide

The v5 release also coincides with the opt-out feature for tokens for public repositories. In the Global Upload Token section of the settings page of an organization in codecov.io, you can set the ability for Codecov to receive a coverage reports from any source. This will allow contributors or other members of a repository to upload without needing access to the Codecov token. For more details see how to upload without a token.

[!WARNING] The following arguments have been changed

  • file (this has been deprecated in favor of files)
  • plugin (this has been deprecated in favor of plugins)

The following arguments have been added:

  • binary
  • gcov_args
  • gcov_executable
  • gcov_ignore
  • gcov_include
  • report_type
  • skip_validation
  • swift_project

You can see their usage in the action.yml file.

What's Changed

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

CybotTM and others added 30 commits September 12, 2025 16:06
…ted script\n\nReplace broken UV_PYTHON_SPEC preview with neutral Python stack preview.\nRoute uv install to scripts/install_uv.sh reconcile.
…ilities

- Show npm, pnpm, yarn prompts unconditionally (outside Node block)
- Update via Corepack; fallback to npm global installs
- Re-audit after each action
- Include black in Python utilities prompt
… prefer yarn@stable

- Ensure corepack enable on update
- corepack prepare pnpm@latest --activate || npm i -g pnpm@latest
- corepack prepare yarn@stable --activate || npm i -g yarn@latest
- Keep npm/eslint/prettier updated
…e/rename.ul

- Skip Corepack shim package.json; invoke real pnpm/yarn for versions
- Prefer Yarn stable and Yarn tags endpoint; upstream_method=yarn-tags
- Detect uv-managed tools via 'uv tool list' and symlink targets; report 'uv tool'
- Separate perl 'prename' and util-linux 'rename.ul' and parse versions
…d via official installer

Detect ~/.local/bin/uv and label as 'github binary'; keep pipx/user for pipx venv symlinks.
Detect pipx-installed Python CLIs and prompt to reinstall with 'uv tool', uninstalling pipx version to avoid shim conflicts; re-audit after action.
- audit: show upstream_method as 'uv tool' for PyPI tools
- guide: migrate any pipx/pip-installed Python CLIs (incl. pip/pipx/ansible-core) to uv tool with uninstall of old shims
…y as 'uv venv'/'uv python'\n\n- Prefer ~/.venvs/dev/bin/python or /home/sme/.local/share/uv/python/cpython-3.13.6-linux-x86_64-gnu/bin/python3.13 for installed Python\n- Show proper installed_method for uv-managed Python\n- Keeps PATH scan fallback for non-uv setups
…- Prefer ansible-community for community version; keep ansible-core CLI present\n- Ensure install_ansible.sh also installs ansible-core via uv to retain ansible shim\n- Detect uv-managed tools via real target path; refine pipx detection\n- Classify npm global installs (user/system) via node_modules real path\n- Improve unknown -> /home/.local/bin classification where appropriate
…Add installed_path_resolved and classification_reason in JSON output\n- Introduce CLI_AUDIT_DEBUG to surface suppressed exceptions\n- Refresh AUDIT_JSON after Ansible install in guide.sh\n- Refactor classification into helper for transparency
…asdf/shims and installs as 'asdf'\n- Classify ~/.nodenv/shims and versions as 'nodenv'
…t DPKG path/owner/version caches to CLI_AUDIT_DPKG_CACHE_LIMIT (default 1024)\n- Prevent unbounded growth during repeated audits
… Introduce COLLECT_ONLY/RENDER_ONLY env modes\n- Add snapshot write/read (tools_snapshot.json) with __meta__\n- Render audit strictly from snapshot in render-only mode\n- Persist upstream lookup method to latest_versions.json on success\n- Improve version detection flags (jq, fzf, ctags, ripgrep, ast-grep) and filter error/usage lines\n- Narrow state column and remove subheaders for compact table\n- Add readiness summary and optional streaming rows
Add comprehensive root agent guide covering:
- Overview (Phase 1 complete, Phase 2 planned)
- Setup with Python 3.10+ requirements
- Build & tests (make audit, update, lint)
- Code style (PEP 8, type hints, frozen dataclasses)
- Security (HTTPS-only, no secrets, rate limiting)
- PR/commit checklist (Conventional Commits)
- Good vs bad examples (dataclasses, locks, parallelization)
- When stuck (troubleshooting workflows)
- House Rules (SOLID, DRY, KISS, testing, docs currency)

Thin root file references scoped AGENTS.md files.
Follows https://github.com/anthropics/claude-code convention.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Add comprehensive guide for 13+ installation scripts:
- Overview (install/update/uninstall/reconcile actions)
- Setup (INSTALL_PREFIX, FORCE_INSTALL, DEBUG)
- Build & tests (individual scripts, Make targets, debug mode)
- Code style (Bash 4.0+, set -euo pipefail, error handling)
- Security (HTTPS downloads, checksum verification, sudo safety)
- PR/commit checklist (shellcheck, test all actions)
- Good vs bad examples (robust downloads, version comparison, cleanup)
- When stuck (debug workflows, PATH issues, reconciliation)
- House Rules (vendor tools preferred, parallel reconciliation)

References Phase 2 ADRs for installation strategy decisions.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
AI Assistant and others added 11 commits October 9, 2025 13:46
Add CLAUDE.md, GEMINI.md, COPILOT.md pointer files directing
to AGENTS.md as canonical source.

Maintains compatibility with various AI coding assistants while
following the public agents.md convention.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Update .envrc to follow AGENTS.md convention:
- Export PROJECT_NAME from basename
- Display welcome message with quick start commands
- Show first-time user guidance

Maintains compatibility with existing Makefile env loading.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Improvements:
- Replace custom help with awk-based format (AGENTS.md convention)
- Add ## annotations to all targets for help display
- Document all audit, install, update, uninstall, reconcile targets

Example output:
  audit                   Render audit from snapshot (no network, <100ms)
  install-python          Install Python toolchain via uv
  update-python           Update Python toolchain
  reconcile-node          Reconcile Node.js to nvm-managed

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Phase 2 Planning (PRD & ADRs):
- PRD.md (29KB): Product requirements, Phase 1 summary, Phase 2 spec
- PHASE2_IMPLEMENTATION.md (58KB): 8-week roadmap, 5 phases
- CONFIGURATION_SPEC.md (33KB): .cli-audit.yml schema reference
- adr/README.md: ADR process and index
- ADR-001: Context-aware installation (workstation/server/ci modes)
- ADR-002: Package manager hierarchy (vendor→GitHub→system)
- ADR-003: Parallel installation approach (keep both, PATH ordering)
- ADR-004: Always-latest version policy (warn on major upgrades)
- ADR-005: Environment detection logic (CI/server/workstation)
- ADR-006: Configuration file format (YAML, multi-location precedence)

Technical Documentation Updates:
- INDEX.md: Added Phase 2 planning section, navigation updates
- QUICK_REFERENCE.md: One-liners, env vars, jq queries
- ARCHITECTURE.md: System design, threading model, cache hierarchy
- API_REFERENCE.md: 50+ functions, environment variables
- FUNCTION_REFERENCE.md: Categorized function catalog
- DEVELOPER_GUIDE.md: Contributing guide, testing strategies
- TOOL_ECOSYSTEM.md: 50+ tool catalog with categories
- DEPLOYMENT.md: Makefile targets, CI/CD integration
- TROUBLESHOOTING.md: Common issues and solutions

AI Agent Context:
- claudedocs/project_context.md: Quick reference for AI agents
- claudedocs/session_summary.md: Session documentation and insights

Total: 12 docs files (189KB), 8 ADRs (71KB), 2 AI context files (19KB)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Document all 13+ installation scripts:
- Overview of multi-action support (install/update/uninstall/reconcile)
- Per-script detailed documentation
- Actions explained (install, update, uninstall, reconcile)
- Usage examples via Make targets
- Troubleshooting per script
- Shared utilities (lib/ directory)
- Best practices and patterns

Scripts covered:
- install_core.sh: fd, fzf, ripgrep, jq, yq, bat, delta, just
- install_python.sh: uv-based Python toolchain
- install_node.sh: nvm-based Node.js
- install_rust.sh: rustup-based Rust
- install_go.sh, install_aws.sh, install_kubectl.sh
- install_terraform.sh, install_ansible.sh, install_docker.sh
- install_brew.sh, install_uv.sh
- guide.sh: Interactive upgrade guide
- test_smoke.sh: Smoke testing

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Add @anthropic-ai/claude-code ^2.0.11 for AI agent integration.

This dependency ensures AI coding agents (like Claude Code) have
proper tooling support. Package required for AI agent context
and project integration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Mode enhancements:
- Add COLLECT_ONLY mode (CLI_AUDIT_COLLECT=1): write snapshot, no output
- Add RENDER_ONLY mode (CLI_AUDIT_RENDER=1): read snapshot, no network
- Snapshot includes __meta__ (schema_version, created_at, count)
- write_snapshot() now returns meta dict

Tracing and diagnostics:
- Add CLI_AUDIT_TRACE for ultra-verbose output
- Add CLI_AUDIT_TRACE_NET for HTTP request tracing
- Add _vlog(), _tlog() helper functions
- Add SLOW_MS threshold for performance tracking

HTTP improvements:
- Make http_fetch() retry parameters configurable via env vars
- Add HTTP_RETRIES, HTTP_BACKOFF_BASE, HTTP_BACKOFF_JITTER
- Add network tracing (request status, retries, errors)

Version detection improvements:
- Filter error/usage lines from version output
- Improve jq, fzf, ctags, ripgrep, ast-grep version detection
- Handle --help output that contains version info

Performance:
- Persist upstream lookup method to latest_versions.json on success
- Narrow state column in table output
- Remove subheaders for more compact display
- Add readiness summary
- Optional streaming rows

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Version updates:
- npm: 10.8.3 → 11.6.2
- pipx: 1.7.1 → 1.8.0
- poetry: 1.8.3 → 2.2.1
- yarn: 4.5.1 → 4.9.4

Method persistence:
- Add __methods__ section tracking upstream lookup methods
- Persist successful lookup methods for faster future queries

This cache update improves performance by recording which
upstream API (pypi, npm, github, crates) successfully resolved
each tool's latest version.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Ignore node_modules/ directory from @anthropic-ai/claude-code
dependency. Minimal Node.js usage (AI agent integration only).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Major documentation reorganization following best practices:

Documentation Organization:
- Move PROJECT_GUIDE.md to docs/ for proper organization
- Move ARCHITECTURE_DIAGRAM.md to docs/ for technical documentation
- Move DEVELOPMENT_QUICKSTART.md to docs/ for developer resources
- Preserve important claudedocs/ content in committed docs/
  - logging_framework.md → docs/LOGGING.md
  - phase2_completion_report.md → docs/PHASE2_COMPLETION_REPORT.md
  - comprehensive_code_review.md → docs/CODE_REVIEW.md
- Add docs/DOCUMENTATION_ORGANIZATION.md for organization rationale
- Update .gitignore to exclude claudedocs/ (AI agent session context)

Phase 2 Implementation (Complete):
- Add cli_audit package with 11 modules (5,338 LOC)
- Phase 2.1: Foundation (environment, config, package_managers, install_plan)
- Phase 2.2: Core installation (installer with retry and validation)
- Phase 2.3: Bulk operations (parallel installation with progress tracking)
- Phase 2.4: Upgrade management (version comparison, breaking changes)
- Phase 2.5: Reconciliation (multi-installation detection and management)
- Phase 2.6: Logging framework (structured logging with console/file output)

Testing Infrastructure:
- Add comprehensive test suite (292 tests, 4,907 LOC)
- Unit tests for all 11 Phase 2 modules
- Integration tests for end-to-end workflows
- Test fixtures for configuration validation

Development Infrastructure:
- Add CI/CD workflows (GitHub Actions)
  - ci.yml: Matrix testing (Python 3.10-3.12, Linux/macOS)
  - release.yml: Automated releases with PyPI publishing
  - dependabot.yml: Automated dependency updates
- Add development tooling configuration
  - .flake8: Linting rules
  - mypy.ini: Type checking configuration
  - pytest.ini: Test configuration
  - pyproject.toml: Package metadata and dependencies
- Add CONTRIBUTING.md with comprehensive contributor guide

Documentation:
- Add docs/PHASE2_API_REFERENCE.md (78 API symbols across 11 modules)
- Add docs/phase2_api/environment.md (detailed module documentation)
- Add docs/CODE_REVIEW.md (comprehensive quality assessment: 9.3/10)
- Add docs/LOGGING.md (logging framework documentation)
- Update README.md with Phase 2 features and code examples

Quality:
- Zero circular dependencies across 11 modules
- Comprehensive type hints throughout
- Frozen dataclasses for immutability
- Thread-safe progress tracking
- Retry logic with exponential backoff
- Checksum verification for downloads
- Breaking change detection and warnings
- System tool safelist (26 protected tools)

Cross-references updated in PHASE2_API_REFERENCE.md and environment.md
to reflect new documentation locations.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[email protected]>
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 4 to 5.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](codecov/codecov-action@v4...v5)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Oct 10, 2025

Labels

The following labels could not be found: ci, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Oct 27, 2025

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/github_actions/codecov/codecov-action-5 branch October 27, 2025 11:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants