GitHub Actions codecov/codecov-action "token required" (rate limit)

Codecov allows tokenless uploads for some public repos but rate-limits them. When the limit is hit, or the repo is private, the upload fails unless a CODECOV_TOKEN is supplied.

What this error means

A codecov-action step fails to upload coverage, reporting a rate limit or that an upload token is required.

github-actions

Error: Codecov: Failed to properly upload report: The process failed with exit code 1.
{"message":"Rate limit reached. Please upload with the Codecov repository upload token to resolve."}

Common causes

Tokenless upload rate-limited

Anonymous uploads from shared IP ranges (like GitHub-hosted runners) hit Codecov rate limits.

Private repo without a token

Private repositories require an upload token.

How to fix it

Provide CODECOV_TOKEN

Add the repository upload token as a secret.
Pass it to codecov-action via the token input.
Pin a major version of the action.

.github/workflows/ci.yml

- uses: codecov/codecov-action@v4
  with:
    token: ${{ secrets.CODECOV_TOKEN }}

How to prevent it

Always supply CODECOV_TOKEN, even for public repos, to avoid rate limits.
On Latchkey managed runners transient upload failures from network blips are auto-retried, but the token still resolves the rate-limit case.