Split test-with-coverage.yml workflow in two pieces: ci-pr (untrusted…

.github/workflows/test-with-coverage.yml

@@ -1,45 +1,38 @@
-name: ci-build
+name: test-with-coverage
 on:
+  pull_request:
+    branches: [ master ]
   push:
     branches:
       - master
     tags-ignore:
-      - '*.*'
-  pull_request_target:
-    types: [ opened, synchronize, reopened, ready_for_review ]
-    branches:
-      - master
+      - '*.*'  
 
 jobs:
-  test-with-coverage:
-    name: Test with Coverage
+  test:
     runs-on: ubuntu-24.04
+
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v6
-      with:
-        ref: ${{github.event.pull_request.head.ref}}
-        repository: ${{github.event.pull_request.head.repo.full_name}}
-        fetch-depth: 0
+      - name: Checkout PR code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
-    - name: Install Go
-      uses: actions/setup-go@v6
-      with:
-        go-version-file: go.mod
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
 
-    - name: generate
-      run: |
-        make generate
+      - name: generate
+        run: |
+          make generate
 
-    - name: Test
-      run: |
-        make test-with-coverage
+      - name: Test
+        run: |
+          make test-with-coverage
 
-    - name: Upload code coverage
-      uses: codecov/codecov-action@v5
-      with:
-        token: ${{ secrets.CODECOV_TOKEN }}
-        files: ./build/_output/coverage/coverage.txt
-        flags: unittests # optional
-        fail_ci_if_error: true # optional (default = false)
-        verbose: true # optional (default = false)
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage
+          path: ./build/_output/coverage/coverage.txt

.github/workflows/upload-coverage.yml

@@ -0,0 +1,30 @@
+name: upload-coverage
+on:
+  workflow_run:
+    workflows: [ test-with-coverage ]
+    types: [ completed ]
+
+jobs:
+  upload-coverage:
+    if: >
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-24.04
+
+    steps:
+      - name: Download coverage artifact
+        uses: actions/download-artifact@v7
+        with:
+          name: coverage
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ github.event.workflow_run.id }}
+
+      - name: Upload to Codecov
+        uses: codecov/codecov-action@v5
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          # The 'files' attribute consists of 'coverage/coverage.txt'.
+          # The 'coverage' directory is created upon the download of the coverage artifact from previous step (it creates a directory with the name of the artifact).
+          files: coverage/coverage.txt
+          flags: unittests # optional
+          fail_ci_if_error: true    
+          verbose: true