[BUG] skip_validation parameter has no effect

[pylipp]

Describe the bug
Setting skip_validation: true has no effect.
(I'm aware it's not recommended to set it).

To Reproduce
Steps to reproduce the behavior:

1. Set skip_validation: true in an upload command
2. Run the job
3. Check CircleCI logs
4. See that validation is actually executed

Expected behavior
Validation is skipped.

Product Area
CircleCI orb

Versions

• Git Host: GitHub
• CI/CD: CircleCI
• Uploader: codecov-circleci-orb@v5.4.3

Commit and CI link
https://app.circleci.com/pipelines/github/boxwise/boxtribute/7894/workflows/94eb0b85-8353-41fc-b79f-5f02947ee939/jobs/48125
Output from Setup env variables:

export CODECOV_PLUGINS=noop
export CODECOV_NETWORK_PREFIX=
export CODECOV_COMMAND=
export CODECOV_DRY_RUN=0
export CODECOV_BASE_SHA=
export CODECOV_FILES=coverage/coverage-final.json
export CODECOV_BRANCH=
export CODECOV_DISABLE_TELEM=0
export CODECOV_OS=
export CODECOV_ENTERPRISE_URL=
export CODECOV_CLI_URL=
export CODECOV_DISABLE_SEARCH=0
export CODECOV_SWIFT_PROJECT=
export CODECOV_BUILD_URL=
export CODECOV_GIT_SERVICE=
export CODECOV_NAME=
export CODECOV_GCOV_EXECUTABLE=
export CODECOV_LEGACY=0
export CODECOV_FILENAME=
export CODECOV_VERBOSE=0
export CODECOV_JOB_CODE=
export CODECOV_USE_PYPI=0
export CODECOV_RECURSE_SUBMODULES=0
export CODECOV_BINARY_LOCATION=
export CODECOV_FORCE=0
export CODECOV_SLUG=
export CODECOV_DIR=
export CODECOV_ENV=
export CODECOV_DISABLE_FILE_FIXES=0
export CODECOV_PUBLIC_PGP_KEY=
export CODECOV_YML_PATH=
export CODECOV_BUILD=
export CODECOV_CODE=
export CODECOV_SKIP_VALIDATION=1
export CODECOV_REPORT_TYPE=coverage
export CODECOV_RUN_CMD=upload-coverage
export CODECOV_GCOV_IGNORE=
export CODECOV_SERVICE=
export CODECOV_VERSION=latest
export CODECOV_EXCLUDES=
export CODECOV_FAIL_ON_ERROR=0
export CODECOV_WRAPPER_VERSION=
export CODECOV_PARENT_SHA=
export CODECOV_SHA=
export CODECOV_PR=
export CODECOV_DOWNLOAD_ONLY=
export CODECOV_HANDLE_NO_REPORTS_FOUND=0
export CODECOV_GCOV_INCLUDE=
export CODECOV_BINARY=
export CODECOV_GCOV_ARGS=
export CODECOV_NETWORK_ROOT_FOLDER=
export CODECOV_NETWORK_FILTER=
export CODECOV_FLAGS=frontend

Output from validate-step:

gpg: directory '/home/circleci/.gnupg' created
gpg: keybox '/home/circleci/.gnupg/pubring.kbx' created
gpg: /home/circleci/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM.sig
 
gpg: Signature made Wed 30 Jul 2025 09:03:11 PM UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
codecov: OK
==> CLI integrity verified

Additional context

• The upload step interprets the skip_validation parameter as 1 or 0.
• the wrapper however compares against the string true

[linear]

CCMRG-1514 [BUG] skip_validation parameter has no effect