chore(ci): skip coverage upload for external fork PRs

External contributors' PRs fail when uploading coverage reports because GitHub Actions doesn't expose secrets to workflows triggered by forks (security measure). This adds a conditional to skip the coverage job for external PRs while still running tests. Coverage will still run for: - Dependabot PRs (same repository) - Internal team PRs (same repository) - Pushes to master (post-merge) External contributors will see their tests pass successfully without the coverage upload step.

.github/workflows/python-app.yml

@@ -79,6 +79,9 @@ jobs:
  coverage:
  needs: test
  runs-on: ubuntu-latest
+ # Only run coverage for PRs from the same repository (not forks)
+ # This ensures secrets are available for Codecov and Codacy
+ if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push'
  strategy:
  matrix:
  service: [codecov, codacy]
@@ -107,8 +110,8 @@ jobs:
 
  container:
  needs: coverage
- runs-on: ubuntu-latest
  if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+ runs-on: ubuntu-latest
 
  permissions:
  contents: read