Codecov uploader TLS validation with a private CA: no documented CA bundle option
0 reputation · 26 Oct 2024, 20:35 UTC
Goal
Upload coverage reports from CI runners that sit behind a corporate TLS-inspecting proxy, where the Codecov endpoint presents a certificate chained to a private CA. The upload should succeed with full certificate validation intact, not with verification disabled.
Constraint
From what I can determine, the Codecov uploader (recent versions) validates TLS against the system default CA store and exposes no documented flag, environment variable, or config file key to point at an alternative CA bundle. The only documented escape hatch appears to be --no-verify, which disables validation entirely and is not acceptable for production uploads.
Modifying the runner's system trust store is possible but requires privileged access on shared CI infrastructure and affects every other process on the host, so I would prefer an uploader-scoped option if one exists.
Questions
- Is there any supported way to supply a custom CA bundle to the Codecov uploader (flag, env var, or codecov.yml setting) that I may have missed in the documentation?
- If not, does the uploader honor standard variables such as
SSL_CERT_FILEorREQUESTS_CA_BUNDLEthrough its underlying HTTP stack? - Short of
--no-verify, what is the recommended approach for runners where the system trust store cannot be modified?
