meta: bump codecov/codecov-action from 7.0.0 to 7.1.1

[dependabot]

Bumps codecov/codecov-action from 7.0.0 to 7.1.1.

Release notes

Sourced from codecov/codecov-action's releases.

v7.1.1

What's Changed

• chore(release): 7.1.1 by @​thomasrockhu-codecov in codecov/codecov-action#1973

Full Changelog: codecov/codecov-action@v7.1.0...v7.1.1

v7.1.0

What's Changed

• chore(release): 7.1.0 by @​thomasrockhu-codecov in codecov/codecov-action#1971

Full Changelog: codecov/codecov-action@v7.0.0...v7.1.0

Commits

• 303a32d chore(release): 7.1.1 (#1973)
• 0b35c9e chore(release): 7.1.0 (#1971)
• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
codecov/codecov-action	[< 4, > 3.1.4]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ns-control-tower]

Walkthrough

Dependabot bumps codecov/codecov-action from v7.0.0 to v7.1.1 across the three coverage workflows, swapping the pinned commit SHA (fb8b358… → 303a32d…) in the Upload step of:

• .github/workflows/coverage-linux.yml:80
• .github/workflows/coverage-linux-without-intl.yml:80
• .github/workflows/coverage-windows.yml:96

The with.directory: ./coverage configuration is unchanged. I verified the pinned SHAs against the upstream tags: the annotated v7.1.1 tag dereferences to commit 303a32d7a59b442fa8d48b6a1cc6825c09c847a5, and the replaced v7.0.0 tag dereferences to fb8b3582c8e4def4969c97caa2f19720cb33a72f — so the pins are accurate for the claimed versions. This is a same-major (7.0.0 → 7.1.1) release made up of chore(release) commits per the codecov-action changelog.

Assessment

• Supply chain: SHA-pinning by immutable commit hash is the recommended posture, and the new SHA is the genuine v7.1.1 release commit. No uses: changes to a moving tag, no new inputs/options introduced by this diff, and no permissions or token scope changes in the workflow steps.
• Correctness: The three edits are identical in nature and only touch the action version; no workflow logic, job dependencies, or step arguments changed. No risk of mismatched action versions within a run.
• CI: No combined commit status or check runs are available on the head yet. This is expected — the modified workflows are the coverage-upload jobs themselves, so they don't gate the PR, and the bump is a routine release-tracking change.

No component interactions or data flow to diagram for a three-line action-pin bump; PR Lens diagram skipped per the skill's carve-out.

Verdict: APPROVE — verified SHA-pinned Dependabot bump within the same major version, with no logic, permissions, or configuration changes.