Bash script checksums do not match published values. Please contact [email protected] immediately.

[ruohola]

I'm using codecov/codecov-action@967e2b38a85a62bd61be5529ada27ebc109948c2 (pinned with 967e2b3 hash for security and consistency), and got the following error:

2021-05-26T18:19:23.4564809Z ##[group]Run codecov/codecov-action@967e2b38a85a62bd61be5529ada27ebc109948c2
2021-05-26T18:19:23.4565629Z with:
2021-05-26T18:19:23.4566533Z   token: ***
2021-05-26T18:19:23.4566983Z   files: ./clover.xml
2021-05-26T18:19:23.4567455Z   fail_ci_if_error: true
2021-05-26T18:19:23.4567924Z ##[endgroup]
2021-05-26T18:19:23.9405524Z ##[warning]Codecov 1.0.3 checksums for SHA1 failed to match.
Public checksum:   nullUploader checksum: 3b699a4d1c42fe4331196730f561df0a653bcc60
2021-05-26T18:19:23.9424019Z ##[error]Codecov failure: Bash script checksums do not match published values. Please contact [email protected] immediately.
2021-05-26T18:19:23.9427345Z ##[error]Codecov failed with the following error: Codecov failure: Bash script checksums do not match published values. Please contact [email protected] immediately.
2021-05-26T18:19:23.9551136Z Post job cleanup.

Should I be worried?

I already emailed [email protected] about this as well.

[ruohola]

The issue seems to be that https://codecov.io/bash has this version line:

VERSION="1.0.3"

but the checksum validation in 967e2b3 only has checksums for 1.0.1 and 1.0.2:

codecov-action/src/validate.ts

Lines 29 to 40 in 967e2b3

	'1.0.1': {
	'1': '0ddc61a9408418c73b19a1375f63bb460dc947a8',
	'256': '89c658e261d5f25533598a222fd96cf17a5fa0eb3772f2defac754d9970b2ec8',
	'512': 'd075b412a362a9a2b7aedfec3b8b9a9a927b3b99e98c7c15a2b76ef09862ae' +
	'b005e91d76a5fd71b511141496d0fd23d1b42095f722ebcd509d768fba030f159e',
	},
	'1.0.2': {
	'1': '537069158a6f72b145cfe5f782dceb608d9ef594',
	'256': 'd6aa3207c4908d123bd8af62ec0538e3f2b9f257c3de62fad4e29cd3b59b41d9',
	'512': 'b6492196dd844cd81a688536bb42463d28bd666448335c4a8fc7f8f9b9b9af' +
	'c346a467e3401e3fc49e6047442a30d93a4adfaa1590101224a186013c6179c48d',
	},

Why on earth is the URL for the bash uploaded at https://codecov.io/bash not versioned at all?
(And yes, I saw that in a1ed4b3 the uploader is used straight from the repo now.)

[thomasrockhu]

@ruohola this has been resolved in version 1.5.0 of the action

[3sevensixyoungtlez]

#239

[ruohola]

#239

?