fix(ci): pin codecov-action v7.0.0 and enforce the CLI signature check (LAB-3433)

[27Bslash6]

Summary

This PR hardens the CI coverage upload step against a known security issue in the Codecov GitHub Action.

Changes

• Pinned codecov-action to v7.0.0 (from v6.0.0), updating the commit SHA accordingly.
• Set fail_ci_if_error: true (previously false) to enforce the CLI's signature-verification check.
• Added continue-on-error: true to the step so a failed upload does not cause the overall CI run to fail.

Why

In the Codecov action, the fail_ci_if_error flag doubles as the switch that enforces GPG signature verification of the CLI's SHA256SUM. When set to false, a failed gpg --verify was only logged and the unverified binary still executed — which is what v6.0.0 did on every run after Codecov deleted its Keybase signing key (see codecov/codecov-action#1956, 2026-06-07).

By keeping fail_ci_if_error: true, the step now aborts before executing an unverified binary. The added continue-on-error: true preserves the previous behavior of not turning CI red on a failed upload — which is all false was actually accomplishing before.

---

Pin codecov-action to v7.0.0 and enforce CLI signature verification

Summary

This PR updates the CI workflow to pin the codecov-action to v7.0.0 and clarifies the signature enforcement behavior for coverage uploads.

Changes

• Pinned codecov/codecov-action to v7.0.0 (commit fb8b3582c8e4def4969c97caa2f19720cb33a72f), upgrading from the previous version.
• Improved documentation comments around the fail_ci_if_error setting to explain its role as a signature-enforcement switch.

Context & Rationale

The fail_ci_if_error flag doubles as the wrapper's signature-enforcement switch. When set to false, a failed gpg --verify of the CLI's SHA256SUM is only logged, and the unverified binary still executes — the vulnerable behavior that v6.0.0 exhibited after Codecov moved its public key off the keybase account that v6.0.0 fetched it from (see codecov/codecov-action#1956).

By keeping fail_ci_if_error: true, the step aborts before executing an unverified binary, while continue-on-error: true ensures upload failures don't fail the CI pipeline.

The updated comments also provide guidance for interpreting an orange (warning) step status:

• A "Could not verify signature" message means the signature guard is working as intended and should never be silenced.
• An upload error (e.g., token or network issues) only results in the loss of that particular coverage upload.

Reference

• LAB-3433

[coderabbitai]

Warning

Review limit reached

Next included review available in 15 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 80 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 15b8a14c-05f3-480b-8c01-a61e6d48ffdc

📥 Commits

Reviewing files that changed from the base of the PR and between f9c9790 and b7b46a9.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 64a25081-ffaa-4431-adbd-32eab3c066e6

📥 Commits

Reviewing files that changed from the base of the PR and between 906942d and f9c9790.

📒 Files selected for processing (1)

• .github/workflows/ci.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

Walkthrough

The coverage job upgrades the Codecov action from v6.0.0 to v7.0.0. It now fails the upload step when verification or wrapper errors occur.

Changes

Codecov CI configuration

Layer / File(s)	Summary
Coverage upload error handling .github/workflows/ci.yml	The coverage job uses Codecov action v7.0.0. continue-on-error is removed, and fail_ci_if_error is set to true.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to f9c97

The Codecov upload verification issue is addressed without introducing merge-blocking CI risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main changes: pinning codecov-action to v7.0.0 and enforcing the CLI signature check. It is concise and specific.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch lab-3433-codecov-v7-signature-check

---

_{Comment @coderabbitai help to get the list of available commands.}

[kodus-27b]

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration

Interacting with Kody

• Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

• Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

• Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration

Review Options

The following review options are enabled or disabled:

Options	Enabled
Bug	✅
Performance	✅
Security	✅
Business Logic	✅

Access your configuration settings here.

​

[27Bslash6]

Signature verification proof on head b7b46a9 — run 34686845068, coverage job, Upload coverage step (job log):

CC_FAIL_ON_ERROR: true
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
==> CLI integrity verified

No public key, no valid OpenPGP data found, Could not verify signature: 0 occurrences each. All three appear on every v6.0.0 run, e.g. main run 33723759860.

After verification the step exits 1 because the upload itself is rejected: Token required because branch is protected. That is pre-existing (the step is tokenless) and happens on push and PR events alike; fail_ci_if_error: false used to turn it green. continue-on-error absorbs it, so the step shows failed-but-continued while the coverage job and CI Success stay green. Fixing the rejection (token, OIDC, or dropping the upload) is tracked separately as LAB-3435.

Expert panel on this diff (bug-hunter, security, craftsman, pragmatism; high stakes): security and pragmatism returned no findings; the craftsman's wording corrections and the shared observability point (orange step must be readable from the log) landed in b7b46a9. Full record on LAB-3433.