search

coverallsapp / github-action

Coveralls Github Action
https://coveralls.io
MIT License
455 stars 76 forks source link

`pull_request_target` trigger is treated as `push` rather than a pull request #206

Open alexbatashev opened 2 months ago

alexbatashev commented 2 months ago

Coveralls GitHub Action requires a secret token, that is only available for pull requests in two cases: 1) Pull request was open from the same repository 2) GitHub Action workflow was triggered by pull_request_target event.

The latter, however, appears to be completely ignored by this action. I do not receive a PR comment, and the UI is showing that the target commit is my main branch HEAD.

Apparently, Coveralls uses $GITHUB_SHA to identify the commit. Which in case of pull_request_target equals to the main commit, not the PR commit. I tried fixing that with the following snippet:

    - id: sha
      run: echo "SHA=$(git rev-parse HEAD)" > $GITHUB_OUTPUT
    - name: Coveralls
      uses: coverallsapp/github-action@v2
      with:
        git-commit: ${{ steps.sha.outputs.SHA }}

but the commit hash on the Coveralls UI remains the same, and the comparison fails.

Here's an example of a PR: https://github.com/perf-toolbox/tir/pull/29 And whatever was generated for that event: https://coveralls.io/builds/67039590 Even though I delete a bunch of tests, the Coveralls shows that the PR introduced no changes. Only after I commit that PR, I can see my updated coverage info.