Post coverage comment #1914
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Post coverage comment | |
| on: # zizmor: ignore[dangerous-triggers] We're using workflow_run to post a coverage comment on external PRs. This is safe because we don't checkout the external code. The only attack vector here would be via the coverage comment. | |
| workflow_run: | |
| workflows: ["CI"] | |
| types: | |
| - completed | |
| concurrency: | |
| # Group by the PR's branch: `github.ref` is always the default branch here, | |
| # so grouping on it would make unrelated PRs cancel each other. | |
| group: ${{ github.workflow }}-${{ github.event.workflow_run.head_branch }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| test: | |
| name: Publish coverage comment | |
| runs-on: ubuntu-latest | |
| if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success' | |
| permissions: | |
| actions: read # Download the comment artifact from the triggering CI run | |
| pull-requests: write # Post the coverage comment on the PR, and edit it on later runs | |
| contents: read | |
| steps: | |
| - name: Post comment | |
| uses: py-cov-action/python-coverage-comment-action@main # zizmor: ignore[unpinned-uses] Dogfooding | |
| with: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_PR_RUN_ID: ${{ github.event.workflow_run.id }} |