Problem
The tarpaulin workflow is the only permanently red check in the repository, and it carries a stack of obsolete machinery:
| Item |
State |
actions-rs/tarpaulin@v0.1 |
unmaintained, runs on Node 20, which GitHub force-migrated to Node 24 on 2026-06-16 |
version: '0.22.0' |
cargo-tarpaulin pinned to a 2022 release; current is 0.34.x |
| OpenSSL 1.1 step |
downloads libssl1.1_1.1.1f-1ubuntu2_amd64.deb from the Ubuntu Bionic archive and installs it with dpkg on ubuntu-24.04 |
| edition support |
tarpaulin 0.22.0 rejects edition 2024 (unknown variant '2024', expected one of '2015', '2018', '2021') |
The pinned tarpaulin is also what blocks the edition bump needed by the Rust atoms work.
Proposal
Replace the workflow with cargo-llvm-cov, installed through taiki-e/install-action:
- source-based LLVM coverage, no OpenSSL hack, no third-party wrapper action
--lcov output consumed directly by codecov/codecov-action- no edition restrictions
Housekeeping that comes with it:
git mv .github/workflows/tarpaulin.yml .github/workflows/coverage.yml- drop
[lints.rust] unexpected_cfgs = { check-cfg = ['cfg(tarpaulin)'] } from Cargo.toml (no cfg(tarpaulin) is used anywhere in src)
- replace
tarpaulin-report.html with lcov.info in .gitignore
Out of scope
Upstream also fails the upload step with Token required because branch is protected, which needs a CODECOV_TOKEN repository secret. That is a repository setting, not a code change; the workflow passes the secret through so it starts working as soon as the secret exists.
Problem
The
tarpaulinworkflow is the only permanently red check in the repository, and it carries a stack of obsolete machinery:actions-rs/tarpaulin@v0.1version: '0.22.0'libssl1.1_1.1.1f-1ubuntu2_amd64.debfrom the Ubuntu Bionic archive and installs it withdpkgonubuntu-24.04unknown variant '2024', expected one of '2015', '2018', '2021')The pinned tarpaulin is also what blocks the edition bump needed by the Rust atoms work.
Proposal
Replace the workflow with
cargo-llvm-cov, installed throughtaiki-e/install-action:--lcovoutput consumed directly bycodecov/codecov-actionHousekeeping that comes with it:
git mv .github/workflows/tarpaulin.yml .github/workflows/coverage.yml[lints.rust] unexpected_cfgs = { check-cfg = ['cfg(tarpaulin)'] }fromCargo.toml(nocfg(tarpaulin)is used anywhere insrc)tarpaulin-report.htmlwithlcov.infoin.gitignoreOut of scope
Upstream also fails the upload step with
Token required because branch is protected, which needs aCODECOV_TOKENrepository secret. That is a repository setting, not a code change; the workflow passes the secret through so it starts working as soon as the secret exists.