codecov.io: we're throttled

[tarasmadan]

Describe the bug
Our coverage uploads to codecov.io are throttled.

To Reproduce
https://github.com/google/syzkaller/actions/runs/9016979839/job/24774648282?pr=4790

Expected behavior
100% of the codecov.io uploads are successfull.

Additional context
Codecov.io is pushing customers to use tokenized uploads.
We don't use github secrets storage and I like it because there is no information to protect.

[tarasmadan]

We can't use token as a job env variable because it may be exfiltrated by Makefile.
In our case token should be the specific step parameter.

[tarasmadan]

Tried to use codecov@v4 with token.
It submitted the report, but used tokenless upload because the submission was done from the fork.
People at codecov/feedback#358 are struggling from the tokenless uploads from forks being throttled.

It means we can switch to v4 with token but it will not solve the problem and I have no idea what's the current codecov.io plan.

[tarasmadan]

One month ago the error was different:
[2024-04-11T12:30:17.461Z] ['error'] There was an error running the uploader: Error uploading to [https://codecov.io:](https://codecov.io/) Error: There was an error fetching the storage URL during POST: 404 - {'detail': ErrorDetail(string='Unable to locate build via Github Actions API. Please upload with the Codecov repository upload token to resolve issue.', code='not_found')}

But the recommendation was the same - use token.

[tarasmadan]

Let's switch to v4 with token. It will not solve the current problem but at least I have a feeling this change moves us forward.

[tarasmadan]

• added CODECOV_TOKEN to dependabot secrets

[dvyukov]

Tried to use codecov@v4 with token. It submitted the report, but used tokenless upload because the submission was done from the fork. People at codecov/feedback#358 are struggling from the tokenless uploads from forks being throttled.

It means we can switch to v4 with token but it will not solve the problem and I have no idea what's the current codecov.io plan.

Will it help if we change our CI scripts to not upload coverage reports from forks?
It should be possible to obtain repo in github actions. It's not strict protection, but I would assume 99% of forks won't change scripts to override the check.

[tarasmadan]

According to the documentation,
"Tokenless uploading is unsupported. However, PRs made from forks to the upstream public repos will support tokenless (e.g. contributors to OS projects do not need the upstream repo's Codecov token)."

The next PRs storm from you will clarify the status :)

Will it help if we change our CI scripts to not upload coverage reports from forks?

My proposal is to do nothing. If this problem still exists I expect it to be fixed soon.