Remove Codecov third party orb dependency in CI (#898)

Summary:
Pull Request resolved: #898

Restores CI runs following #888, where our CircleCI security policy prevents the use of any third party orbs.

https://pxl.cl/2lbJL

Reviewed By: robhogan

Differential Revision: D41436440

fbshipit-source-id: da0ce96232658058304de4e81145084521414b7a

.circleci/config.yml

@@ -4,7 +4,6 @@
 version: 2.1
 
 orbs:
-  codecov: codecov/[email protected]
   win: circleci/[email protected]
 
 references:
@@ -70,8 +69,12 @@ jobs:
       - checkout
       - yarn_install
       - run: yarn test-coverage
-      - codecov/upload:
-          file: ./coverage/coverage-final.json
+      - run:
+          name: Download Codecov Uploader
+          command: ./.circleci/scripts/install_codecov.sh
+      - run:
+          name: Upload coverage results
+          command: ./codecov -t ${CODECOV_TOKEN} -f ./coverage/coverage-final.json
 
   test-linux:
     <<: *secure_unset_publish_token

.circleci/scripts/install_codecov.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+# Install Codecov Uploader
+# See https://docs.codecov.com/docs/codecov-uploader#using-the-uploader-with-codecovio-cloud
+
+CODECOV_URL="https://uploader.codecov.io"
+
+curl "${CODECOV_URL}/verification.gpg" | gpg --no-default-keyring --keyring trustedkeys.gpg --import
+curl -Os "${CODECOV_URL}/latest/linux/codecov"
+curl -Os "${CODECOV_URL}/latest/linux/codecov.SHA256SUM"
+curl -Os "${CODECOV_URL}/latest/linux/codecov.SHA256SUM.sig"
+
+gpgv codecov.SHA256SUM.sig codecov.SHA256SUM
+shasum -a 256 -c codecov.SHA256SUM
+
+chmod +x codecov