From 01d07d045d3409d23ea336c68bf73fc77c4038c8 Mon Sep 17 00:00:00 2001 From: Wojtek Zieba Date: Tue, 9 Jun 2026 13:29:25 +0200 Subject: [PATCH] Fix Codecov key fetch in coverage upload Codecov rotated their Keybase username from codecovsecurity to codecovsecops (the new URL serves the same key fingerprint 27034E7FDB850E0BBC2C62FF806BB28AED779869). The old URL now returns a 32-byte 404 body that curl was happily piping into gpg, breaking the import and aborting run-unit-tests.sh under `set -e` before merge_junit_reports could run. Also add `--fail --silent --show-error` so any future move surfaces as a curl failure with a clear message instead of an opaque gpg error. Co-Authored-By: Claude Opus 4.7 (1M context) --- .buildkite/commands/upload-code-coverage.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.buildkite/commands/upload-code-coverage.sh b/.buildkite/commands/upload-code-coverage.sh index 844becbcdb74..6145584df564 100755 --- a/.buildkite/commands/upload-code-coverage.sh +++ b/.buildkite/commands/upload-code-coverage.sh @@ -1,6 +1,6 @@ #!/bin/bash -eu -curl https://keybase.io/codecovsecurity/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import +curl --fail --silent --show-error https://keybase.io/codecovsecops/pgp_keys.asc | gpg --no-default-keyring --keyring trustedkeys.gpg --import curl -Os https://uploader.codecov.io/latest/linux/codecov curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM curl -Os https://uploader.codecov.io/latest/linux/codecov.SHA256SUM.sig