What happened
.github/workflows/coverage.yml hardcodes a Codecov upload token in plaintext and passes it to a third-party action:
- line 30 —
token: <redacted> (a Codecov upload token, committed in the clear)
- line 26 —
uses: codecov/codecov-action@v3
- line 16 —
uses: actions/checkout@master
(I've redacted the token value here on purpose and have not tested it against any service — I'm only reporting that a credential is committed.)
Why it matters
A credential committed to a public repository is readable by anyone and should be treated as compromised. Codecov upload tokens are limited in scope (they permit uploading coverage reports, not code push/read), so the blast radius is bounded — but the standard, low-risk fix is to rotate the token and move it to a repository secret. Every other credential in this repo's workflows already uses ${{ secrets.* }} (e.g. DOCKERHUB_TOKEN, NEXUS_PW), so this one line is the exception.
There's also a small supply-chain angle: the token is handed to codecov/codecov-action@v3 (a mutable major tag) in a job that also uses actions/checkout@master (a mutable branch), so pinning those to full commit SHAs would harden the path the credential flows through.
Suggested fix
- Rotate the current Codecov token (regenerate it in Codecov).
- Store it as a repository secret and reference it:
token: ${{ secrets.CODECOV_TOKEN }}.
- (Optional) Pin
codecov/codecov-action and actions/checkout to full commit SHAs.
Happy to send a PR for the workflow change once the token is rotated (I understand PRs need an ICLA on file). I used AI assistance to spot this; I verified the file and line numbers myself and did not exfiltrate or use the credential.
What happened
.github/workflows/coverage.ymlhardcodes a Codecov upload token in plaintext and passes it to a third-party action:token: <redacted>(a Codecov upload token, committed in the clear)uses: codecov/codecov-action@v3uses: actions/checkout@master(I've redacted the token value here on purpose and have not tested it against any service — I'm only reporting that a credential is committed.)
Why it matters
A credential committed to a public repository is readable by anyone and should be treated as compromised. Codecov upload tokens are limited in scope (they permit uploading coverage reports, not code push/read), so the blast radius is bounded — but the standard, low-risk fix is to rotate the token and move it to a repository secret. Every other credential in this repo's workflows already uses
${{ secrets.* }}(e.g.DOCKERHUB_TOKEN,NEXUS_PW), so this one line is the exception.There's also a small supply-chain angle: the token is handed to
codecov/codecov-action@v3(a mutable major tag) in a job that also usesactions/checkout@master(a mutable branch), so pinning those to full commit SHAs would harden the path the credential flows through.Suggested fix
token: ${{ secrets.CODECOV_TOKEN }}.codecov/codecov-actionandactions/checkoutto full commit SHAs.Happy to send a PR for the workflow change once the token is rotated (I understand PRs need an ICLA on file). I used AI assistance to spot this; I verified the file and line numbers myself and did not exfiltrate or use the credential.