Fix: replace pull_request_target with a download/upload artifact.

.github/workflows/coverage-comment.yml

@@ -0,0 +1,51 @@
+name: Comment wuth API Coverage
+
+# read-write repo token
+# access to secrets
+on:
+  workflow_run:
+    workflows: ["Gather API Coverage"]
+    types:
+      - completed
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Download Coverage Report
+        uses: actions/[email protected]
+        with:
+          script: |
+            var artifacts = await github.actions.listWorkflowRunArtifacts({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               run_id: ${{github.event.workflow_run.id }},
+            });
+            var matchArtifact = artifacts.data.artifacts.filter((artifact) => {
+              return artifact.name == "coverage.json"
+            })[0];
+            var download = await github.actions.downloadArtifact({
+               owner: context.repo.owner,
+               repo: context.repo.repo,
+               artifact_id: matchArtifact.id,
+               archive_format: 'zip',
+            });
+            var fs = require('fs');
+            fs.writeFileSync('${{github.workspace}}/coverage.json', Buffer.from(download.data));
+
+      - name: 'Comment on PR'
+        uses: actions/github-script@v3
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const data = require('./coverage.json');
+            console.log(data);
+            await github.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: data.pull_request,
+              body: "API specs implemented for ${{ data.current }}/${{ data.total }} (${{ data.percent }}%) APIs."
+            });

.github/workflows/coverage.yml → .github/workflows/coverage-gather.yml

@@ -1,6 +1,6 @@
-name: API Coverage
+name: Gather API Coverage
 
-on: [push, pull_request_target]
+on: [push, pull_request]
 
 env:
   JAVA_VERSION: 11
@@ -14,8 +14,6 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
-        with:
-           ref: ${{ github.event.pull_request.head.sha }}
       - name: Build Spec
         working-directory: ./tools
         run: |-
@@ -50,14 +48,15 @@ jobs:
           total=`jq -r '.paths | keys | length' build/local-openapi.json`
           percent=$((current * 100 / total))
           echo "API specs implemented for $current/$total ($percent%) APIs."
-          cat >>"$GITHUB_OUTPUT" <<EOL
-          current=$current
-          total=$total
-          percent=$percent
+          cat >>"coverage.json" <<EOL
+          {
+            "pull_request":${{ github.event.number }},
+            "current":$current,
+            "total":$total,
+            "percent":$percent
+          }
           EOL
-      - uses: peter-evans/create-or-update-comment@v4
-        if: github.event_name == 'pull_request_target'
+      - uses: actions/upload-artifact@v2
         with:
-          issue-number: ${{ github.event.number }}
-          body: |
-            API specs implemented for ${{ steps.coverage.outputs.current }}/${{ steps.coverage.outputs.total }} (${{ steps.coverage.outputs.percent }}%) APIs.
+          name: coverage
+          path: coverage.json