fix: Add retry logic and error handling for GPP key import (v0.2.8)

[thomasrockhu-codecov]

Summary

Fixes random CI/CD pipeline failures caused by intermittent GPG key import failures when downloading the verification key from keybase.io.

Problem

• No error checking on curl command (silent failures with -s flag)
• No retry logic for network failures
• No validation that the key was successfully downloaded
• No error handling for GPG import failures
• No informative logging for debugging

This caused random CI/CD pipeline failures for all users, as the verification process would fail unpredictably when network issues occurred or when keybase.io was temporarily unavailable.

Solution

• Added retry loop (3 attempts with 2-second delays)
• Added explicit error checking for curl command with -f flag
• Added validation that downloaded key is not empty
• Added error checking for GPG import operation
• Added informative logging for each attempt
• Provide clear error message suggesting CODECOV_SKIP_VALIDATION workaround if all attempts fail

Testing

• Tested retry logic with simulated network failures
• Verified successful import on first attempt when network is stable
• Verified proper error handling and logging on failures
• Confirmed backward compatibility with existing workflows

Related Issues

• Addresses [BUG] Random fails due to uploader verification key import failing codecov-action#1876
• Improves reliability for all users of codecov-action and prevent-action

Release

This includes version bump to 0.2.8

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.14%. Comparing base (b636c79) to head (1daddc8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #66   +/-   ##
=======================================
  Coverage   97.14%   97.14%           
=======================================
  Files           2        2           
  Lines          35       35           
=======================================
  Hits           34       34           
  Misses          1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[AndreKurait]

@thomasrockhu-codecov @calvin-codecov This looks good, we have seen this happening occasionally. Any release target to get this merged?

[calvin-codecov]

I don't see an earlier check to make sure CODECOV_COMMAND is guaranteed "codecov-cli" or "sentry-prevent-cli" here like in codecov.sh.

[blimpich]

Any progress here? We're still experiencing this bug

[blimpich]

Bump

[blimpich]

Bump

[AndreKurait]

@joseph-sentry any help here?

[blimpich]

@thomasrockhu-codecov any updates here?

[thomasrockhu-codecov]

Superseded by #68 (#68). Closing in favor of that PR.

[blimpich]

Those PRs themselves are closed though?

[thomasrockhu-codecov]

@blimpich sorry, automation problem, I'll get this shipped by EOW