[BUG] Integrity Checks always fail on macos and windows GHA runners

[jviall]

Describe the bug
I run a matrix of tests in GitHub Actions for python 3.9, 3.13, on both Windows and macOS (the latest version of GH's runner for both)--4 combinations. For all combinations, the Codecov action fails to check the integrity of the CLI, seemingly because the SHA256SUM file it tries to download doesn't actually exist. Based on the output below, there are typos in the URLs that the wrapper attempts to fetch SHAs from.

To Reproduce
Steps to reproduce the behavior:

1. Create a GitHub Workflow running on macos-latest or windows-latest that produces test-coverage output
2. Call the codecov/codecov-action@v5 action with validation left on (the default)

Expected behavior
Validation succeeds

Regression
N/A

Screenshots
If applicable, add screenshots to help explain your problem.

Product Area
If applicable, the product with the given bug (e.g. coverage, test analytics, browser extension, bundle analysis)

Versions

• OS: macos arm64, windows
• Git Host: GitHub
• CI/CD: GitHub Actions
• Uploader: codecov-action@v5

Commit and CI link
https://github.com/jviall/rekordbox-bulk-edit/actions/runs/17001197380/job/48352227732
https://github.com/jviall/rekordbox-bulk-edit/tree/1d05f89d3c68b687a1fd32b3c9bb311e34fee159

Run ${GITHUB_ACTION_PATH}/dist/codecov.sh
  ${GITHUB_ACTION_PATH}/dist/codecov.sh
  shell: C:\Program Files\Git\bin\bash.EXE --noprofile --norc -e -o pipefail {0}
  env:
    OS: windows-latest
    PYTHON: 3.13
    CODECOV_TOKEN: ***
    pythonLocation: C:\hostedtoolcache\windows\Python\3.13.6\x64
    PKG_CONFIG_PATH: C:\hostedtoolcache\windows\Python\3.13.6\x64/lib/pkgconfig
    Python_ROOT_DIR: C:\hostedtoolcache\windows\Python\3.13.6\x64
    Python2_ROOT_DIR: C:\hostedtoolcache\windows\Python\3.13.6\x64
    Python3_ROOT_DIR: C:\hostedtoolcache\windows\Python\3.13.6\x64
    VENV: .venv/scripts/activate
    CC_FORK: false
    CC_TOKEN: ***
    CC_BRANCH: 
    CC_SHA: 
    CC_PR: 
    CC_BASE_SHA: 
    CC_BINARY: 
    CC_BUILD: 
    CC_BUILD_URL: 
    CC_CODE: 
    CC_DIR: .coverage
    CC_DISABLE_FILE_FIXES: false
    CC_DISABLE_SEARCH: false
    CC_DISABLE_TELEM: false
    CC_DRY_RUN: false
    CC_ENTERPRISE_URL: 
    CC_ENV: OS,PYTHON
    CC_EXCLUDES: 
    CC_FAIL_ON_ERROR: false
    CC_FILES: 
    CC_FLAGS: 
    CC_FORCE: 
    CC_GCOV_ARGS: 
    CC_GCOV_EXECUTABLE: gcov
    CC_GCOV_IGNORE: 
    CC_GCOV_INCLUDE: 
    CC_GIT_SERVICE: github
    CC_HANDLE_NO_REPORTS_FOUND: false
    CC_JOB_CODE: 
    CC_LEGACY: false
    CC_NAME: 
    CC_NETWORK_FILTER: 
    CC_NETWORK_PREFIX: 
    CC_NETWORK_ROOT_FOLDER: 
    CC_OS: Windows
    CC_PARENT_SHA: 
    CC_PLUGINS: 
    CC_RECURSE_SUBMODULES: false
    CC_REPORT_TYPE: 
    CC_RUN_CMD: upload-coverage
    CC_SERVICE: github
    CC_SKIP_VALIDATION: false
    CC_SLUG: 
    CC_SWIFT_PROJECT: 
    CC_USE_PYPI: false
    CC_VERBOSE: true
    CC_VERSION: latest
    CC_YML_PATH: 
##[debug]C:\Program Files\Git\bin\bash.EXE --noprofile --norc -e -o pipefail D:\a\_temp\f55c18f4-0340-4d30-9c5d-85b72724a9e2.sh
     _____          _
    / ____|        | |
   | |     ___   __| | ___  ___ _____   __
   | |    / _ \ / _` |/ _ \/ __/ _ \ \ / /
   | |___| (_) | (_| |  __/ (_| (_) \ V /
    \_____\___/ \__,_|\___|\___\___/ \_/
                            Wrapper-0.2.1
                                  
==> Overridden OS: Windows
 -> Downloading https://cli.codecov.io/latest/Windows/codecov
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed

  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100   196  100   196    0     0    692      0 --:--:-- --:--:-- --:--:--   695
==> Finishing downloading Windows:latest
      Version: 
 
gpg: directory '/c/Users/runneradmin/.gnupg' created
gpg: /c/Users/runneradmin/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/Windows/codecov.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/Windows/codecov.SHA256SUM.sig
 
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.
==> Could not verify signature. Please contact Codecov if problem continues
sha256sum: codecov.SHA256SUM: no properly formatted SHA256 checksum lines found
==> Could not verify SHASUM. Please contact Codecov if problem continues
==> CLI integrity verified

 -> Token of length 36 detected
==> Running upload-coverage
      ./codecov --verbose upload-coverage -t <redacted> --git-service github --env OS,PYTHON --dir .coverage --gcov-executable gcov
./codecov: line 1: syntax error near unexpected token `<'
./codecov: line 1: `<?xml version='1.0' encoding='UTF-8'?><Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message><Details>No such object: codecov-cli/latest/Windows/codecov</Details></Error>'
==> Failed to run upload-coverage

Additional context
Add any other context about the problem here.

[linear]

CCMRG-1527 [BUG] Integrity Checks always fail on macos and windows GHA runners

[jviall]

It seems like the issue has been fixed in the latest version of the wrapper (0.2.4), but the action is using an out of date version (0.2.1)?

I created a fork of the repo and simply updated the commit of the submodule to the wrapper's v0.2.4 release and now my upload is working great. Would love to contribute if my PR is a correct application of the fix! if not please advise.

[thomasrockhu-codecov]

@jviall thanks for the bump, I'll release a new version of the Action today

[jviall]

@jviall thanks for the bump, I'll release a new version of the Action today

is my PR insufficient/incorrect? would love to contribute

[thomasrockhu-codecov]

@jviall sorry I didn't see your PR, I merged it in, but it's not on the latest version of the wrapper. Going to get this in today and do a release tomorrow morning to be safe

[thomasrockhu-codecov]

@jviall this should be released now!