add codecov-cli and deps

[giovanni-guidini]

These changes were made by following the exact instructions on Readme.md, that is, running python3 -m add_pkg codecov-cli.

This is used in the codecov-ats.yml workflow and currently requires the extra index to Pypi to be installed.
See: https://github.com/getsentry/sentry/blob/d069119cee5dfc887cf3f0744e4c8ebdf9be8a9c/.github/workflows/codecov_ats.yml#L76C100-L76C100

[asottile-sentry]

can we factor this library out -- I really don't want people to be able to use it at sentry. it has some pretty problematic beahviour that can lead to arbitrary downloads in a security-sensitive context. open should be just fine for most usecases and if we need explicit access to alternative stores then that should be used explicitly instead of magically

[asottile-sentry]

similarly I don't think we're processing enough json for this to be meaningful -- the stdlib json parser would be preferable

[giovanni-guidini]

hum... are the standard libs able to stream JSON? That is the reason for us to use these libs.

I can look for alternatives so we don't include these libs. We might be able to pull it off not streaming the JSON too... In the scenario they're used we expect to parse JSONs in the few hundreds of MBs size

I'll research that. Thanks for raising concern about these libs.

[asottile-sentry]

actually ijson is dead and archived too so we definitely should not be using it

for a few 100 MB I doubt it will make a performance difference to just use stdlib json

[asottile-sentry]

oh maybe not archived -- just the pypi url goes to the old maintainer

[asottile-sentry]

to be clear here -- ijson is probably fine -- I don't have major concerns with it but it is unlikely to be solving the problem at hand. smart-open isn't getting you anything though -- normal open is already streamed unless you call .read() on it

[giovanni-guidini]

I'll get rid of smart-open. As you said it's giving us nothing.
But the ijson is serving us a purpose of parsing the JSON file without loading everything into memory. I prefer to keep it.

[giovanni-guidini]

Blocked by codecov/codecov-cli#326 (to remove smart-open) and pending a new release being made

[ghost]

just need to remove smart-open