Upgrade codecov action to v7

[gaiksaya]

Description

Bumping the code coverage action to v7 and separating into different stage

Error observed:

[2026-07-31T21:39:57.930Z] ['error'] There was an error running the uploader: Error uploading to [https://codecov.io:](https://codecov.io/) Error: There was an error fetching the storage URL during POST: 429 - {"message":"Rate limit reached. Please upload with the Codecov repository upload token to resolve issue. Expected time to availability: 2556s."}

Related Issues

https://github.com/opensearch-project/custom-codecs/actions/runs/30666851118/job/91276258302?pr=361
opensearch-project/opensearch-build#6461

Check List

• New functionality includes testing.
• New functionality has been documented.
• API changes companion pull request created.
• Commits are signed per the DCO using --signoff.
• Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[github-actions]

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 4a9684e.

⛔ Hard block: Issues at High severity or above will block this PR from merging.

Path	Line	Severity	Description
.github/workflows/check.yml	44	high	New GitHub Actions dependency added: actions/upload-artifact@043fb46 (v7.0.1). Dependency changes must be verified by maintainers regardless of apparent legitimacy.
.github/workflows/check.yml	55	high	New GitHub Actions dependency added in new codecov job: actions/checkout@93cb6ef (v5). Dependency changes must be verified by maintainers.
.github/workflows/check.yml	57	high	New GitHub Actions dependency added: actions/download-artifact@3e5f45b (v8.0.1). Dependency changes must be verified by maintainers.
.github/workflows/check.yml	62	high	Existing dependency version changed: codecov/codecov-action updated from ab904c41d6ece82784817410c45d8b8c02684457 (v3) to fb8b3582c8e4def4969c97caa2f19720cb33a72f (v7.0.0). Major version bump (v3 -> v7) with a new commit hash must be verified by maintainers.

The table above displays the top 10 most important findings.

Total: 4 | Critical: 0 | High: 4 | Medium: 0 | Low: 0

---

Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.

---

⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit 5e5f506)

Here are some key observations to aid the review process:

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ Recommended focus areas for review Misplaced `if` condition The if: ${{ !cancelled() && contains(matrix.java, '21') }} condition appears as a top-level key alongside uses: on the Upload Coverage Report Artifact step, but its indentation/placement looks off — it's positioned after the step name but before uses:, and the diff shows it was carried over from the removed step. Verify the if is properly attached to the new upload-artifact step; otherwise the artifact upload may run for all Java matrix versions (not just 21), causing conflicting artifact names or the codecov job's download of jacoco-coverage-report-java21 to potentially collide/fail. - name: Upload Coverage Report Artifact if: ${{ !cancelled() && contains(matrix.java, '21') }} uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: jacoco-coverage-report-java${{ matrix.java }} path: build/reports/jacoco/test/jacocoTestReport.xml retention-days: 1 if-no-files-found: error

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@0f2ca1c). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #362   +/-   ##
=======================================
  Coverage        ?   48.88%           
  Complexity      ?      192           
=======================================
  Files           ?       54           
  Lines           ?     1162           
  Branches        ?       64           
=======================================
  Hits            ?      568           
  Misses          ?      558           
  Partials        ?       36           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Persistent review updated to latest commit 5e5f506

[github-actions]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Fix invalid job dependency reference The needs: precommit-linux reference does not match any job defined in the visible workflow (the surrounding job appears to not be named precommit-linux). This will cause the workflow to fail validation. Verify the referenced job name matches the actual test job name. .github/workflows/check.yml [51-53] codecov: - needs: precommit-linux + needs: <actual-test-job-name> if: ${{ !cancelled() && github.repository == 'opensearch-project/custom-codecs' }} Suggestion importance[1-10]: 6 __ Why: The suggestion raises a valid concern about the needs: precommit-linux reference, since the job name isn't visible in the diff. However, the improved code uses a placeholder rather than an actual fix, and the job may exist outside the visible diff.	Low
General	Avoid running codecov on failed builds With !cancelled(), this job will run even when precommit-linux fails and no artifact was uploaded, causing the download step to fail. Consider using success() or checking artifact existence, or guard so codecov only runs on successful test jobs to avoid noisy failures. .github/workflows/check.yml [51-58] codecov: needs: precommit-linux - if: ${{ !cancelled() && github.repository == 'opensearch-project/custom-codecs' }} + if: ${{ success() && github.repository == 'opensearch-project/custom-codecs' }} runs-on: ubuntu-latest steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 - name: Download Coverage Report uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 Suggestion importance[1-10]: 5 __ Why: Valid point that !cancelled() allows the codecov job to run even if the upstream job fails, which would cause the download step to fail. However, the artifact upload also uses !cancelled(), so partial artifacts may still be available; this is a minor robustness improvement.	Low

[reta]

Thanks @gaiksaya !

[gaiksaya]

Hi @reta
Looks like code coverage is 49% . Can we look into increasing it to 70-80% atleast? (usual threshold across org)
https://app.codecov.io/gh/opensearch-project/custom-codecs

Thanks!

[reta]

Hi @reta Looks like code coverage is 49% . Can we look into increasing it to 70-80% atleast? (usual threshold across org) https://app.codecov.io/gh/opensearch-project/custom-codecs

Thanks!

Sure, could you please create an issue? Thank you!