Fix coverage badge on README and docs

[pchlap]

Hi @dalmouiee,

since we merged #176 I noticed that the coverage badge isn't rendering properly on the README and docs page. I think this has to do with the action step which generates the badge only runs on the main branch. But it is defined in the actions file that runs on pull requests. Do you have any thoughts on how we can resolve this? Thanks!

[daniel-almouiee-seetreat]

Hey @pchlap, ah yes I see sorry about that, who would have thought things would work without testing once :P

Yeah seems that the step where it tries to push the badge to the main branch upon merge to main to update ethe coverage badge is failing, because main is protected.

I think to fix this we can either allow the action to push to main directly using a github token like here. Although, if the coverage reporting on the readme is not important we can opt to just remove it and have it as a check for the workflow actions only. Happy to take your call on this, thanks :)

[pchlap]

Hi @daniel-almouiee-seetreat, my only concern is that this workflow runs every time someone opens or updates a pull request. So if we allow the action to update main, would it then do that every time? E.g. it may also update the coverage badge for pull requests we ultimately end up closing and not merging to main at all.

Not a super big deal I guess, but I am thinking this might be a security issue too? Since someone could open a pull request that modifies the action to bypass the PR process and commit something malicious to main. Sure we need to approve action runs of external contributors, but we might not throughly check the code before allowing the action to run.

I am wondering what other OSS repositories on GitHub do here? My thinking is it might be better to take this step out make a new action that runs only when a PR is merged to main. What do you think? But in the interim I'd be fine to remove the badge for now if that's easier.

[dalmouiee]

Hi @daniel-almouiee-seetreat, my only concern is that this workflow runs every time someone opens or updates a pull request. So if we allow the action to update main, would it then do that every time? E.g. it may also update the coverage badge for pull requests we ultimately end up closing and not merging to main at all.

Not a super big deal I guess, but I am thinking this might be a security issue too? Since someone could open a pull request that modifies the action to bypass the PR process and commit something malicious to main. Sure we need to approve action runs of external contributors, but we might not throughly check the code before allowing the action to run.

I am wondering what other OSS repositories on GitHub do here? My thinking is it might be better to take this step out make a new action that runs only when a PR is merged to main. What do you think? But in the interim I'd be fine to remove the badge for now if that's easier.

Yeah that's fine to remove it for the time being, apologies for delay in response. Let's do that, I'll sort it out!