Summary
Bookmark to track the Harness acquisition of Codecov from Sentry (announced 2026-06-02, via PR Newswire) and revisit Vera's Codecov integration once Harness publishes migration specifics (endpoint/domain, token, action repo).
Why a bookmark, not actionable work now
Per the announcement, Codecov retains its brand and free access for open-source projects under Harness — so the risk is migration mechanics, not loss of access. There is nothing to change until Harness announces details. One proactive hardening step is already taken (below).
Impact assessment (current state): LOW
Vera's coverage gate and Codecov reporting are decoupled:
| Layer |
Mechanism |
Codecov-dependent? |
Merge-blocking? |
| 80% coverage floor |
pytest --cov-fail-under=80 (.github/workflows/ci.yml) |
No — pytest-cov, on-runner |
Yes (the test (ubuntu-latest, 3.12) + coverage required check) |
| Coverage upload |
codecov/codecov-action ×2 |
Yes |
No (fail_ci_if_error: false) |
codecov/project · codecov/patch status |
codecov.yml |
Yes |
No (not in branch protection; patch + JS are informational: true) |
| README badge |
codecov.io/.../badge.svg |
Yes |
No |
No codecov/* check is in branch protection's required list, so a Codecov outage during migration cannot block merges or break the coverage floor.
Proactive step taken (see linked PR)
SHA-pinned codecov/codecov-action@v6 → @e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1 in both upload steps. An ownership change is the canonical scenario where a floating tag could be repointed by the new owner; pinning to a reviewed commit means a moved tag can't silently flow into CI. Dependabot (github-actions ecosystem, already configured) keeps proposing version bumps, now gated on human review. Deliberately a targeted pin — the repo otherwise tag-pins all actions.
Revisit / close when Harness announces specifics — watch for:
Watching
Summary
Bookmark to track the Harness acquisition of Codecov from Sentry (announced 2026-06-02, via PR Newswire) and revisit Vera's Codecov integration once Harness publishes migration specifics (endpoint/domain, token, action repo).
Why a bookmark, not actionable work now
Per the announcement, Codecov retains its brand and free access for open-source projects under Harness — so the risk is migration mechanics, not loss of access. There is nothing to change until Harness announces details. One proactive hardening step is already taken (below).
Impact assessment (current state): LOW
Vera's coverage gate and Codecov reporting are decoupled:
pytest --cov-fail-under=80(.github/workflows/ci.yml)test (ubuntu-latest, 3.12) + coveragerequired check)codecov/codecov-action×2fail_ci_if_error: false)codecov/project·codecov/patchstatuscodecov.ymlpatch+ JS areinformational: true)codecov.io/.../badge.svgNo
codecov/*check is in branch protection's required list, so a Codecov outage during migration cannot block merges or break the coverage floor.Proactive step taken (see linked PR)
SHA-pinned
codecov/codecov-action@v6→@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1in both upload steps. An ownership change is the canonical scenario where a floating tag could be repointed by the new owner; pinning to a reviewed commit means a moved tag can't silently flow into CI. Dependabot (github-actionsecosystem, already configured) keeps proposing version bumps, now gated on human review. Deliberately a targeted pin — the repo otherwise tag-pins all actions.Revisit / close when Harness announces specifics — watch for:
codecov.io→ a Harness domain): update the upload URL and the README badge.CODECOV_TOKENre-issuance / auth change: rotate the repo secret.codecov/codecov-actionre-homed (e.g.codecovorg →harness): update theuses:path and re-pin the SHA.codecov/project/pythonstatus behaviour change: confirm it stays non-required / informational as intended.Watching