v5 token-required error on Dependabot PRs: add token to Dependabot secrets

TL;DR

Issue codecov/codecov-action#1653 (closed, 32 comments): v5 upgrade gives new error 'token required because branch is protected'.

Steps

1. Issue codecov/codecov-action#1653 (closed, 32 comments): v5 upgrade gives new error 'token required because branch is protected'. PR upgrading from v4 to v5 has a token in the secrets, but with v5 it fails with the branch-protection error.
2. [thomasrockhu-codecov (commenter)]: If codecov-action v5 fails on Dependabot PRs with "token required because branch is protected" even though the token is in your repo secrets, add CODECOV_TOKEN to your Dependabot secrets too (repo Settings, Secrets and variables, Dependabot). v5 reads the token differently and Dependabot PRs do not inherit regular repository secrets, so the protected-branch check fails without it.

When to use

You are seeing this: PR upgrading from v4 to v5 has a token in the secrets, but with v5 it fails with the branch-protection error. Use this skill when you run into "v5 token-required error on Dependabot PRs: add token to Dependabot secrets".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Issue codecov/codecov-action#1653 (closed, 32 comments): v5 upgrade gives new error 'token required because branch is protected'.

Sources

• https://github.com/codecov/codecov-action/issues/1653

In https://github.com/codecov/codecov-action/issues/1653, the reporter asked: Issue codecov/codecov-action#1653 (closed, 32 comments): v5 upgrade gives new error 'token required because branch is protected'. PR upgrading from v4 to v5 has a token in the secrets, but with v5 it fails with the branch-protection error. The verified answer: [thomasrockhu-codecov (commenter)]: If codecov-action v5 fails on Dependabot PRs with "token required because branch is protected" even though the token is in your repo secrets, add CODECOV_TOKEN to your Dependabot secrets too (repo Settings, Secrets and variables, Dependabot). v5 reads the token differently and Dependabot PRs do not inherit regular repository secrets, so the protected-branch check fails without it. Source thread: https://github.com/codecov/codecov-action/issues/1653