Codecov incident

Codecov uploaders (Action/Orb/Step) fail gpg verification

Notice Resolved View vendor source →

Codecov experienced a notice incident on June 6, 2026, lasting —. The incident has been resolved; the full update timeline is below.

Started
Jun 06, 2026, 01:00 PM UTC
Resolved
Jun 06, 2026, 01:00 PM UTC
Duration
—
Detected by Pingoru
Jun 06, 2026, 01:00 PM UTC

Update timeline

  1. resolved Jun 10, 2026, 03:22 AM UTC

    On Saturday, June 6th, the Codecov gpg public key located at keybase.io/codecovsecurity was absent. This caused widespread outages for users uploading with the Codecov - GitHub Action - CircleCI Orb - Bitrise Step In order to quickly move and prevent further outages, the Codecov team deleted the `codecovsecurity` account and created `codecovsecops` with the same public gpg key. This key can be verified against any pre-existing CLI to prove it is the same key and also at about.codecov.io/security. The key location was updated in all of the above uploaders on the latest versions.