Upload test coverage for PRs via separate workflow

Relates to DependencyTrack#3516

Signed-off-by: nscuro <[email protected]>
Signed-off-by: Mikael Carneholm <[email protected]>

.github/workflows/ci-test-pr-coverage.yml

@@ -0,0 +1,34 @@
+name: Report PR Test Coverage
+
+on:
+  workflow_run:
+    workflows:
+    - Tests CI
+    types:
+    - completed
+
+permissions: { }
+
+jobs:
+  publish:
+    name: Report Coverage
+    runs-on: ubuntu-latest
+    if: |-
+      github.event.workflow_run.event == 'pull_request'
+        && github.event.workflow_run.conclusion == 'success'
+    steps:
+    - name: Download PR test coverage report
+      uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85 # tag=v4.1.3
+      with:
+        name: pr-test-coverage-report
+        run-id: ${{ github.event.workflow_run.id }}
+    - name: Report Coverage to Codacy
+      run: |-
+        bash <(curl -Ls https://coverage.codacy.com/get.sh) report \
+          --organization-provider gh \
+          --username "${GITHUB_REPOSITORY_OWNER}" \
+          --project-name "${GITHUB_REPOSITORY##*/}" \
+          --project-token ${{ secrets.CODACY_PROJECT_TOKEN }} \
+          --commit-uuid "$(cat ./pr-commit.txt)" \
+          --coverage-reports ./jacoco.xml \
+          --language Java

.github/workflows/ci-test.yaml

@@ -45,10 +45,29 @@ jobs:
           mvn clean
           mvn test -P enhance
 
+      # Publishing coverage to Codacy is only possible for builds of push events.
+      # PRs from forks do not get access to repository secrets.
+      # https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
       - name: Publish test coverage
-        if: ${{ contains(github.repository, 'DependencyTrack/') }}
+        if: ${{ github.event_name != 'pull_request' && github.repository_owner == 'DependencyTrack' }}
         uses: codacy/[email protected]
         with:
           project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
           language: Java
           coverage-reports: target/jacoco-ut/jacoco.xml
+
+      - name: Save PR details
+        if: ${{ github.event_name == 'pull_request' }}
+        run: |-
+          echo ${{ github.sha }} > pr-commit.txt
+          echo ${{ github.event.number }} > pr-number.txt
+
+      - name: Upload PR test coverage report
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # tag=v4.3.1
+        with:
+          name: pr-test-coverage-report
+          path: |-
+            pr-commit.txt
+            pr-number.txt
+            target/jacoco-ut/jacoco.xml