From b00259c7b2f86a79afe2bb70e16a782c24c1454f Mon Sep 17 00:00:00 2001 From: Morten Andersen Date: Mon, 24 Aug 2026 13:56:39 +0200 Subject: [PATCH] fix: Add optional `skip-code-coverage-on-pr` flag on `pull-request-kotlin` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On public repositories like the `ocpp-emulator` we accept PRs from forked repositories. For these the step to upload the code coverage on the PR will fail, so this makes it optional (defaults to on) > For pull_request events on a fork PR, GitHub Actions always issues a read-only GITHUB_TOKEN, regardless of what permissions: the workflow declares — this is a hard security restriction to prevent a malicious fork PR from using elevated permissions --- .github/workflows/pull-request-kotlin.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/pull-request-kotlin.yml b/.github/workflows/pull-request-kotlin.yml index 3e5143f..571e69f 100644 --- a/.github/workflows/pull-request-kotlin.yml +++ b/.github/workflows/pull-request-kotlin.yml @@ -48,6 +48,11 @@ on: type: boolean description: "Allow you to skip using Sonar Cloud, only to be used for common modules" default: false + skip-code-coverage-on-pr: + required: false + type: boolean + description: "Allow you to skip writing the code coverage information on the PR. Only relevant for public repositories that allows PRs from forked repositories " + default: false sonar-non-blocking: required: false type: boolean @@ -264,6 +269,7 @@ jobs: gradle-tasks: 'sonar' gradle-args: ${{ inputs.gradle-args }} - name: Add code coverage to PR + if: ${{ !inputs.skip-code-coverage-on-pr }} uses: mi-kas/kover-report@db9938358b8e1e6175dd4136132bf4eb7aa4ae6d # v2 with: title: Code Coverage ${{ inputs.gradle-module }}