[Question]: Coverage from Forks

[dario-coscia]

What is your question?

Hi! I am using your action for our software PINA, and it works very well! We have a workflow that activates your action for every PR received.

However, I am facing some issues when a forked repository tries to do a PR. Your action to create the coverage report tries to push results back to our repo, which requires write permissions. Since forked PRs run in a sandbox with read-only permissions (for security), the workflow fails.

Is there a way to avoid this behaviour and still have the coverage report?

Code of Conduct

• I agree to follow this project's Code of Conduct.

Contribution Guidelines

• I agree to follow this project's Contribution Guidelines.

Security Policy

• I agree to follow this project's Security Policy.

[dario-coscia]

Here are our workflow lines for reference:

https://github.com/mathLab/PINA/blob/efc9e327f6795fa2959009dd3436377583a7ca12/.github/workflows/tester.yml#L56-L78

Thank you in advance for your help!

[cicdguy]

Hello, we can definitely do something about this. We'll take a look.

[dario-coscia]

Hello, we can definitely do something about this. We'll take a look.

👋🏼 Any news on this?

[cicdguy]

Hi there, we looked into this but it might be impossible to support this within the action itself. You could look into doing this as part of your workflow such that the fork is being pulled from and pushed to when you checkout the repo. Then you can also tweak the action parameters to choose between pushing the report for long term storage vs not caring for the previous report at all.

[dario-coscia]

Hi there, we looked into this but it might be impossible to support this within the action itself. You could look into doing this as part of your workflow such that the fork is being pulled from and pushed to when you checkout the repo. Then you can also tweak the action parameters to choose between pushing the report for long term storage vs not caring for the previous report at all.

Hi! Thanks for the answer,I will try this option :)

[dario-coscia]

Hi! We solved it by doing the following as trigger. Maybe it could be useful for someone!

on:
  pull_request_target:

[cicdguy]

Excellent! Thank you also for posting the solution here 👏

[yordis]

@cicdguy do you think the action should figure out how to make this to work without pull_request_target, that is a security liability waiting to happen IMO, we have policy around such thing, we can't use it.