Token ignored on forked repo leading to failed coverage upload

[SebastianAment]

Hi experts,

We are running into coverage upload failures, seemingly for a very similar reason to the issue codecov/feedback#358 (comment), which was fixed at the time by #1471.

Since today (could be related to release 4.6.0) we are running into a similar issue, where the token is ignored for forked repos and the upload fails because the token is required for protected branches, see https://github.com/facebook/Ax/actions/runs/11151452009/job/30994900275?pr=2813.

I'd appreciate your help with this.

Copying the logs:

Run codecov/codecov-action@v4
eventName: pull_request
baseRef: facebook:main | headRef: SebastianAment:export-D63638706
==> Fork detected, tokenless uploading used
==> linux OS detected
https://cli.codecov.io/latest/linux/codecov.SHA256SUM
gpg: directory '/home/runner/.gnupg' created
gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
gpg: /home/runner/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: Signature made Wed Oct  2 15:02:36 2024 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
==> Uploader SHASUM verified (6e36d96b22f37661f378ec7f40c7d89701d4f252d729f4213e7da4c6c2703e85  codecov)
==> Running version latest
==> Running version v0.7.5
==> Running git config --global --add safe.directory /home/runner/work/Ax/Ax
/usr/bin/git config --global --add safe.directory /home/runner/work/Ax/Ax
==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-commit --git-service github -B SebastianAment:export-D63638706 -C 80c40acf2ffbb6e5df25383383941a0cfb8f35ad -Z
info - 2024-10-02 21:09:10,595 -- ci service found: github-actions
warning - 2024-10-02 21:09:10,600 -- No config file could be found. Ignoring config.
info - 2024-10-02 21:09:10,602 -- The PR is happening in a forked repo. Using tokenless upload.
info - 2024-10-02 21:09:10,877 -- Process Commit creating complete
==> Running command '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-report'
/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov create-report --git-service github -C 80c40acf2ffbb6e5df25383383941a0cfb8f35ad -Z
info - 2024-10-02 21:09:[11](https://github.com/facebook/Ax/actions/runs/11151452009/job/30994900275?pr=2813#step:8:12),596 -- ci service found: github-actions
warning - 2024-10-02 21:09:11,602 -- No config file could be found. Ignoring config.
info - 2024-10-02 21:09:11,822 -- Process Report creating complete
error - 2024-10-02 21:09:11,822 -- Report creating failed: {"message":"Token required because branch is protected"}
Error: Codecov:
                        Failed to properly create report: The process '/home/runner/work/_actions/codecov/codecov-action/v4/dist/codecov' failed with exit code 1

[ssbarnea]

For sure v4.6.0 introduced regression around authentication, see #1594

[SebastianAment]

Seems to have been fixed.

[ClementWalter]

I'm using codecov/codecov-action@v4 and facing this issue. How to solve it?