From f21f967dcf0a0b69bb1fee66b873f2387ad8211b Mon Sep 17 00:00:00 2001 From: Ernst Kaese Date: Tue, 25 Aug 2026 11:26:23 +0000 Subject: [PATCH 1/2] feat: upload fork pull request coverage to Codecov --- .github/workflows/codecov-fork-upload.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/codecov-fork-upload.yml diff --git a/.github/workflows/codecov-fork-upload.yml b/.github/workflows/codecov-fork-upload.yml new file mode 100644 index 0000000..ea4a0c2 --- /dev/null +++ b/.github/workflows/codecov-fork-upload.yml @@ -0,0 +1,16 @@ +name: Codecov fork upload + +on: + workflow_run: + workflows: ["Build, lint and test"] + types: + - completed + +permissions: + actions: read + contents: read + +jobs: + codecov-fork: + uses: cloudscape-design/actions/.github/workflows/codecov-fork-upload.yml@main + secrets: inherit From 6ba6b13f25ede93010130962f4badf5171f6b903 Mon Sep 17 00:00:00 2001 From: Ernst Kaese Date: Mon, 31 Aug 2026 12:22:44 +0000 Subject: [PATCH 2/2] fix: grant pull-requests read to the codecov fork upload wrapper The shared codecov-fork-upload workflow requests pull-requests: read for its pull request resolver step. A called reusable workflow's permissions must be a subset of the caller's, so granting only actions and contents made the call fail workflow validation before any job ran. --- .github/workflows/codecov-fork-upload.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/codecov-fork-upload.yml b/.github/workflows/codecov-fork-upload.yml index ea4a0c2..a1d6903 100644 --- a/.github/workflows/codecov-fork-upload.yml +++ b/.github/workflows/codecov-fork-upload.yml @@ -9,6 +9,7 @@ on: permissions: actions: read contents: read + pull-requests: read jobs: codecov-fork: