Skip to content
OutageDeck

Incident detail

Codecov uploaders (Action/Orb/Step) fail gpg verification

Resolved incidentMinor

Timeline window

to

Outage alerts

Get alerted the next time Codecov breaks

Free email alerts for up to 5 providers — no card, live in about a minute. Paid plans add Slack, Discord, and webhook delivery across your whole stack, plus higher API quotas.

Set up free alertsHow Codecov alerts work

Timeline

Incident updates

Updates are normalized from the official source chronology so timeline changes remain easy to scan.

  1. Resolved

    On Saturday, June 6th, the Codecov gpg public key located at keybase.io/codecovsecurity was absent. This caused widespread outages for users uploading with the Codecov

    • GitHub Action
    • CircleCI Orb
    • Bitrise Step

    In order to quickly move and prevent further outages, the Codecov team deleted the `codecovsecurity` account and created `codecovsecops` with the same public gpg key. This key can be verified against any pre-existing CLI to prove it is the same key and also at about.codecov.io/security. The key location was updated in all of the above uploaders on the latest versions.