Update Godot export action pin and configure Codecov token - #736
Merged
Merged
Conversation
Bumps [firebelley/godot-export](https://github.com/firebelley/godot-export) from 7.0.0 to 8.0.0. - [Release notes](https://github.com/firebelley/godot-export/releases) - [Commits](firebelley/godot-export@9305776...615a6f7) --- updated-dependencies: - dependency-name: firebelley/godot-export dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Merge from master
…lley/godot-export-8.0.0 Bump firebelley/godot-export from 7.0.0 to 8.0.0
ikostan
added this to the
Milestone 19: UI Audio Infrastructure & Centralized SFX Systems milestone
ikostan
added
CI/CD
dependencies
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideUpdates CI workflows to use a newer pinned revision of the firebelley/godot-export GitHub Action and ensures the Codecov upload step has the required token set via environment variables. Flow diagram for updated CI export and Codecov stepsflowchart TD
Start[CI workflow triggered] --> ExportWeb[Run firebelley/godot-export@615a6f7afc22d6266bf55c17748fb07447e8bdab]
ExportWeb --> BuildArtifacts[Generate web build artifacts]
BuildArtifacts --> CodecovUpload[Upload coverage with Codecov action]
CodecovUpload --> EnvToken[Use env CODECOV_TOKEN from secrets]
EnvToken --> End[CI job completes]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
📝 WalkthroughWalkthroughThis PR updates GitHub Actions workflow configuration across four files. Three workflows synchronize their pinned revision of the ChangesWorkflow configuration updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Python |  |
Jun 2, 2026 5:04a.m. | Review ↗ |
| JavaScript | |
Jun 2, 2026 5:04a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Owner
Author
|
@sourcery-ai title |
sourcery-ai
Bot
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/gut_tests.yml (1)
68-73:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winMake Codecov token usage consistent (env var is already sufficient)
The workflow exports
CODECOV_TOKEN, andcodecov upload-processwill automatically useCODECOV_TOKENfrom the environment, so passing--token ${{ secrets.CODECOV_TOKEN }}is redundant and leaves inconsistent token sourcing. Remove the--tokenflag (or switch to--token $CODECOV_TOKEN).Suggested change (remove redundant flag)
REPORT_FILE="${{ steps.find_report.outputs.latest_report }}/gut_junit.xml" if [ -f "$REPORT_FILE" ]; then - ./codecov upload-process --token ${{ secrets.CODECOV_TOKEN }} -f "$REPORT_FILE" --name "GUT Test Report" --flag GUT --report-type test_results + ./codecov upload-process -f "$REPORT_FILE" --name "GUT Test Report" --flag GUT --report-type test_results else🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/gut_tests.yml around lines 68 - 73, Remove the redundant explicit token flag from the codecov invocation so it relies on the already-exported CODECOV_TOKEN environment variable; update the ./codecov upload-process invocation (the line referencing REPORT_FILE and calling upload-process) to drop --token ${{ secrets.CODECOV_TOKEN }} and keep the remaining flags (--name, --flag, --report-type) so the command uses the environment-provided CODECOV_TOKEN.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/gut_tests.yml:
- Around line 68-73: Remove the redundant explicit token flag from the codecov
invocation so it relies on the already-exported CODECOV_TOKEN environment
variable; update the ./codecov upload-process invocation (the line referencing
REPORT_FILE and calling upload-process) to drop --token ${{
secrets.CODECOV_TOKEN }} and keep the remaining flags (--name, --flag,
--report-type) so the command uses the environment-provided CODECOV_TOKEN.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: 072fcddf-507c-425b-9281-65017faec5c5
📒 Files selected for processing (4)
.github/workflows/browser_test.yml.github/workflows/codeql.yml.github/workflows/deploy_to_itch.yml.github/workflows/gut_tests.yml
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: GDUnit4 Unit Tests / unit-test
- GitHub Check: CI/CD Infrastructure Tests / Test Deployment Scripts
- GitHub Check: GUT Unit Tests / unit-test
- GitHub Check: Sourcery review
🧰 Additional context used
🧠 Learnings (2)
📚 Learning: 2026-04-28T02:11:45.806Z
Learnt from: ikostan
Repo: ikostan/SkyLockAssault PR: 588
File: .github/workflows/deploy_to_itch.yml:44-56
Timestamp: 2026-04-28T02:11:45.806Z
Learning: When a CI workflow edits Godot's `project.godot` (INI) to inject custom ProjectSettings values, insert the setting key under the correct section header that matches the `game/` (or other) root in the ProjectSettings path. For example, `ProjectSettings.get_setting("game/security/save_salt", ...)` expects the INI entry under `[game]` with key `security/save_salt` (i.e., `[game]` then `security/save_salt=...`), not under `[application]`. Otherwise the lookup will fall back to the default value at runtime.
Applied to files:
.github/workflows/codeql.yml.github/workflows/deploy_to_itch.yml.github/workflows/browser_test.yml.github/workflows/gut_tests.yml
📚 Learning: 2026-05-20T00:01:27.632Z
Learnt from: ikostan
Repo: ikostan/SkyLockAssault PR: 654
File: .github/workflows/browser_test.yml:99-101
Timestamp: 2026-05-20T00:01:27.632Z
Learning: In this repository’s GitHub Actions workflows, treat supply-chain pinning as follows:
- **Do not flag** steps that use **first-party** GitHub-owned actions under `actions/*` (e.g., `actions/checkout`, `actions/cache`) when they use a **major version tag** like `v6` / `v5`.
- **Do flag** **third-party** actions (anything not under `actions/*`, e.g., `firebelley/godot-export`, `codecov/codecov-action`) when they use an unpinned ref such as `vX` or `main` instead of being pinned to a **commit SHA** (i.e., `@<commit-sha>`).
Applied to files:
.github/workflows/codeql.yml.github/workflows/deploy_to_itch.yml.github/workflows/browser_test.yml.github/workflows/gut_tests.yml
🔇 Additional comments (3)
.github/workflows/codeql.yml (1)
41-41: Action pin updated consistently with other workflows.This workflow uses the same commit SHA as
browser_test.yml. Please review the verification comment inbrowser_test.yml(line 48) regarding the v8.0.0 upgrade to ensure no breaking changes affect this workflow's configuration..github/workflows/deploy_to_itch.yml (1)
64-64: Action pin updated consistently with other workflows.This workflow uses the same commit SHA as the other workflows in this PR. Note that this workflow uses
archive_output: true(line 70), which differs from the other two workflows. Please review the verification comment inbrowser_test.yml(line 48) to ensure v8.0.0 doesn't introduce breaking changes to archive output behavior..github/workflows/browser_test.yml (1)
48-48: Confirmfirebelley/godot-export@615a6f7afc22d6266bf55c17748fb07447e8bdabmaps to v8.0.0 and check breaking changes
615a6f7afc22d6266bf55c17748fb07447e8bdabis tagged asv8.0.0.- The
v8.0.0release notes only mention bumping the action to Node 24 and don’t document any breaking changes affecting inputs/outputs/behavior.
github-project-automation
Bot
moved this from In Progress
to Done
in Sky Lock Assault Project
8 tasks
7 tasks
8 tasks
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
name: Default Pull Request Template
about: Suggesting changes to SkyLockAssault
title: ''
labels: ''
assignees: ''
Description
What does this PR do? (e.g., "Fixes player jump physics in level 2" or "Adds
new enemy AI script")
Related Issue
Closes #ISSUE_NUMBER (if applicable)
Changes
system")
Testing
works on Win10 with 60 FPS")
Checklist
Additional Notes
Anything else? (e.g., "Tested on Win10 64-bit; needs Linux validation")
Summary by Sourcery
Update CI workflows to use the latest pinned Godot export action and ensure test reports upload correctly to Codecov.
CI:
Summary by CodeRabbit