From ecc199ea082383a6fd78598950db3e245f55657e Mon Sep 17 00:00:00 2001
From: Rahim Rahman <rahim.rahman@mattermost.com>
Date: Tue, 18 Mar 2025 13:18:12 -0600
Subject: [PATCH] ci(MM-63199): fix download artifact issue (#8690)

* remove some test

* clean error

* use has_coverage_from_main

* revert sentry.test.ts
* remove use of github_token

* trying github.token instead

* see if permissions write will solve the Resource not accessible problem

* would github-token help solve that problem?

* see if permissions on the workflow itself would fix the problem

* trying pull_request_target

* add branches to pull request target

* remove branches for now.

* changed to the proper event_name

* check if it's forked repo.

* using is_fork
---
 .github/actions/test-coverage/action.yml | 39 ++++++++++++++++--------
 .github/workflows/ci.yml                 |  4 ++-
 scripts/compare-coverage.sh              |  1 -
 3 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/.github/actions/test-coverage/action.yml b/.github/actions/test-coverage/action.yml
index 3a90bed64..7deab32cc 100644
--- a/.github/actions/test-coverage/action.yml
+++ b/.github/actions/test-coverage/action.yml
@@ -10,9 +10,6 @@ name: test-coverage
 description: Test coverage tracking for mobile repo
 
 inputs:
-  github_token:
-    description: The token to use to download the coverage result
-    required: true
   run_id:
     description: The run id to use to download the coverage result
     required: true
@@ -40,22 +37,33 @@ runs:
       run: |
         echo "::group::set-pr-condition"
         if [ -f "run-id.txt" ]; then
-          echo "IS_PR_WITH_CACHE=true" >> $GITHUB_ENV
+          echo "HAS_MAIN_RUN_ID=true" >> $GITHUB_ENV
           echo "LAST_RUN_ID=$(cat run-id.txt)" >> $GITHUB_ENV
         fi
         echo "::endgroup::"
 
     - name: ci/download-main-coverage
-      if: env.IS_PR_WITH_CACHE == 'true'
+      if: env.HAS_MAIN_RUN_ID == 'true'
+      continue-on-error: true
       uses: actions/download-artifact@v4
       with:
         name: test-coverage-result-${{ env.LAST_RUN_ID }}
         path: main-coverage/
-        github-token: ${{ inputs.github_token }}
+        github-token: ${{ github.token }}
         run-id: ${{ env.LAST_RUN_ID }}
 
+    - name: ci/check-coverage-download
+      if: env.HAS_MAIN_RUN_ID == 'true'
+      shell: bash
+      run: |
+        echo "::group::check-coverage-download"
+        if [ -f "main-coverage/coverage-summary.json" ]; then
+          echo "HAS_COVERAGE_FROM_MAIN=true" >> $GITHUB_ENV
+        fi
+        echo "::endgroup::"
+
     - name: ci/read-coverage
-      if: env.IS_PR_WITH_CACHE == 'true'
+      if: env.HAS_COVERAGE_FROM_MAIN == 'true'
       shell: bash
       run: |
         echo "::group::read-coverage"
@@ -70,23 +78,29 @@ runs:
         echo "::endgroup::"
 
     - name: ci/compare-coverage
-      if: env.IS_PR_WITH_CACHE == 'true'
+      if: env.HAS_COVERAGE_FROM_MAIN == 'true'
       id: compare-coverage
       shell: bash
       run: |
         echo "::group::compare-coverage"
+        echo "IS_FORK=false" >> $GITHUB_ENV
         output=$(./scripts/compare-coverage.sh \
           ./main-coverage \
           ./coverage \
-          ${{ github.event.pull_request.number }} \
-          ${{ inputs.github_token }})
+          ${{ github.event.pull_request.number }})
         echo "report<<EOF" >> $GITHUB_ENV
         echo "$output" >> $GITHUB_ENV
         echo "EOF" >> $GITHUB_ENV
+        if [ "${{ github.event.pull_request.head.repo.fork }}" = "true" ]; then
+          echo "IS_FORK=true" >> $GITHUB_ENV
+          echo "::warning::PR is from a fork. Coverage report will be displayed in the workflow summary."
+          echo "### Coverage Report from Fork" >> $GITHUB_STEP_SUMMARY
+          echo "$output" >> $GITHUB_STEP_SUMMARY
+        fi
         echo "::endgroup::"
 
     - name: ci/post-coverage-report
-      if: env.IS_PR_WITH_CACHE == 'true'
+      if: env.HAS_COVERAGE_FROM_MAIN == 'true' && env.IS_FORK == 'false'
       uses: thollander/actions-comment-pull-request@v3
       with:
         message: ${{ env.report }}
@@ -94,7 +108,7 @@ runs:
         create-if-not-exists: true
 
     - name: ci/exit-on-test-coverage-failure
-      if: env.IS_PR_WITH_CACHE == 'true'
+      if: env.HAS_COVERAGE_FROM_MAIN == 'true'
       shell: bash
       run: |
         echo "::group::exit-on-test-coverage-failure"
@@ -109,6 +123,7 @@ runs:
         name: test-coverage-result-${{ inputs.run_id }}
         path: coverage/coverage-summary.json
         overwrite: true
+        github-token: ${{ github.token }}
 
     - name: ci/set-upload-success
       if: github.ref_name == 'main' && steps.upload-coverage.outcome == 'success'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0622ffc04..876aecf54 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,6 +7,9 @@ on:
       - 'release*'
   pull_request:
 
+permissions:
+  pull-requests: write
+
 env:
   NODE_VERSION: 20.13.1
   TERM: xterm
@@ -23,5 +26,4 @@ jobs:
         if: github.event_name == 'pull_request' || github.ref_name == 'main'
         uses: ./.github/actions/test-coverage
         with:
-          github_token: ${{ secrets.MM_MOBILE_GITHUB_TOKEN }}
           run_id: ${{ github.run_id }}
diff --git a/scripts/compare-coverage.sh b/scripts/compare-coverage.sh
index a33a5c5bf..5e3d80757 100755
--- a/scripts/compare-coverage.sh
+++ b/scripts/compare-coverage.sh
@@ -5,7 +5,6 @@ PR_COVERAGE_THRESHOLD=80.0
 MAIN_COVERAGE_FILE="$1/coverage-summary.json"
 RECENT_COVERAGE_FILE="$2/coverage-summary.json"
 PR_NUMBER="$3"
-GITHUB_TOKEN="$4"
 
 if [ ! -f "$MAIN_COVERAGE_FILE" ] || [ ! -f "$RECENT_COVERAGE_FILE" ]; then
     echo "One or both coverage files not found"