Feat(build seq) codecov, use bash instead of npm module.

[sukrosono]

Fix #1077

[codecov]

Codecov Report

Merging #1078 into master will not change coverage.
The diff coverage is n/a.

@@          Coverage Diff           @@
##           master   #1078   +/-   ##
======================================
  Coverage    93.6%   93.6%           
======================================
  Files          32      32           
  Lines        1626    1626           
  Branches      393     393           
======================================
  Hits         1522    1522           
  Misses        104     104

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2eafe73...2897512. Read the comment docs.

[keithamus]

Hey @brutalcrozt thanks for the PR.

I feel really uncomfortable downloading and executing aribtrary bash on my local machine, and on CI (where we have secret tokens like account passwords). The 300k is only downloaded for developers/ci (where it is also heavily cached), so I think it's adequete to keep it. I'll close this PR, you did the right thing in the original PR, and changing to running arbitrary bash would be a bad move IMO.

[astorije]

Something I often see is adding the dependency in the build config itself and not package.json:

install:
  - npm install -g codecov
script:
  - ...
  - codecov

That would solve what you were trying to solve, @brutalcrozt, without relying on a bash download.

---

In fact, considering codecov is currently not installed -globally, how come running codecov works? I'd expect to see ./node_modules/.bin/codecov in there instead, unless Travis runs their script section from ./node_modules/.bin itself.

[keithamus]

how come running codecov works

I believe Travis have ./node_modules/.bin in the PATH.

...adding the dependency in the build config...

We could make travis install codecov independantly, but I would like to draw complexity out of our travis scripts and into tooling that can work agnostic of CI - especially as I'd like to add appveyor into our toolchain for testing IE without saucelabs, so package.json feels right to me. Other should comment though, we should reach a consensus.

[meeber]

I like the self-documenting nature of keeping the dev dependency in package.json. I'd like to keep it as-is.