ci: Fix posting coverage comments

[kjarosh]

Let's do some random stuff and hope it works

[torokati44]

I'm not 100% sure that secrets like these are exposed for runs done in forks (for PRs).

[Dinnerbone]

I'm not 100% sure that secrets like these are exposed for runs done in forks (for PRs).

They aren't, this would require each fork to have that secret defined - if it did, it would give our secret to anybody.

[torokati44]

FWIW: https://github.com/emilk/egui/actions/runs/17862090972/workflow#L58

[torokati44]

There are 20k+ lines of ruffle_core::html::layout: Fallback font not found ... for ..., text will be missing logged in the coverage test 💀

[torokati44]

The

permissions:
  contents: write
  pull-requests: write

part is probably necessary? (present in the SO answer and the linked workflow as well)

[torokati44]

My current guess is that in the egui repo it works because the workflow that posts the comment is not triggered on the PR itself, but on the completion of such a workflow run.

[SuchAFuriousDeath]

Let's do some random stuff and hope it works

Me when I'm programming:

[danielhjacobs]

Per https://github.com/thollander/actions-comment-pull-request?tab=readme-ov-file#permissions

Note that, if the PR comes from a fork, it will have only read permission despite the permissions given in the action for the pull_request event. In this case, you may use the pull_request_target event. With this event, permissions can be given without issue (the difference is that it will execute the action from the target branch and not from the origin PR).