fix(ci): stop failing external PRs on missing coverage token - #1765
Merged
Conversation
report.yml previously tried to comment on the PR with a secret token in the same job that pull_request triggers for fork PRs, which GitHub always runs without secrets. That made the coverage step fail outright on every external contribution even when the build and tests passed. Split the work: report.yml now only builds and uploads the jacoco XML reports plus PR metadata as an artifact, no secrets needed. A new report-comment.yml, triggered by workflow_run, downloads that artifact and posts the comment. workflow_run jobs always run in the base repo's context with full secrets, regardless of what triggered the run they react to, so this works the same way for fork and internal PRs.
The earlier workflow_run split to post coverage comments for fork PRs tripped the repo's mandatory zizmor security scan, which blocks any use of the workflow_run trigger regardless of how it is used. Revert to a single job. Fork PRs still cannot get a coverage comment, since secrets.SYNCED_GITHUB_TOKEN_REPO is never available to a pull_request run triggered by a fork, but continue-on-error on that step stops it from failing the whole check. The build and test steps above it remain the real pass/fail signal.
kikoso
changed the title
Contributor
Code Coverage
|
dkhawk
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The Report tests results workflow (report.yml) fails on every pull request from a fork, even when the build and tests pass. Root cause: the final Jacoco Report to PR step needs secrets.SYNCED_GITHUB_TOKEN_REPO to comment on the PR, and GitHub never exposes repo secrets to a pull_request triggered run from a fork. The step errors with 'token' is missing and the whole job is reported as failed.
Seen on #1758.
Fix
Add continue-on-error: true to the Jacoco Report to PR step, so that step's failure no longer fails the job or the check. The build and test steps above it are unchanged and remain the real signal for whether the PR is good.
Note this does not make the coverage comment itself appear on fork PRs, since secrets are still never available to a pull_request run triggered by a fork. I initially tried a workflow_run based split to get the comment posted for fork PRs too, but that trips this repo's mandatory zizmor security scan, which blocks any use of the workflow_run trigger outright regardless of how it is used (confirmed against zizmor's own docs, no accepted mitigation exists for that trigger). Given that constraint, this settles for external PRs going green without a coverage comment, rather than overriding the security gate.
Test plan