From f00ac4b7660ead0a45492bc6c7a589c974dc8400 Mon Sep 17 00:00:00 2001 From: Tom Hu Date: Mon, 8 Jun 2026 18:18:37 -0600 Subject: [PATCH 1/2] fix: fetch Codecov PGP key from keybase.io/codecovsecops The Codecov security PGP key moved from keybase.io/codecovsecurity to keybase.io/codecovsecops. Update the bundled uploader script so GPG signature validation imports the key from the correct location. Co-authored-by: Cursor --- dist/codecov.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dist/codecov.sh b/dist/codecov.sh index 0b77171..897574f 100755 --- a/dist/codecov.sh +++ b/dist/codecov.sh @@ -110,7 +110,7 @@ then chmod +x "$CC_COMMAND" fi else - echo "$(curl -s https://keybase.io/codecovsecurity/pgp_keys.asc)" | \ + echo "$(curl -s https://keybase.io/codecovsecops/pgp_keys.asc)" | \ gpg --no-default-keyring --import # One-time step say "$g==>$x Verifying GPG signature integrity" From 0fb7174895f61a3b6b78fc075e0cd60383518dac Mon Sep 17 00:00:00 2001 From: Tom Hu Date: Mon, 8 Jun 2026 18:18:38 -0600 Subject: [PATCH 2/2] chore(release): 5.5.5 Co-authored-by: Cursor --- CHANGELOG.md | 8 ++++++++ src/version | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2091711..ab88b2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +## v5.5.5 + +### What's Changed +* fix: fetch Codecov PGP key from keybase.io/codecovsecops + +**Full Changelog**: https://github.com/codecov/codecov-action/compare/v5.5.4..v5.5.5 + + ## v5.5.2 ### What's Changed diff --git a/src/version b/src/version index c8f1d09..e69889c 100644 --- a/src/version +++ b/src/version @@ -1 +1 @@ -5.5.4 +5.5.5