From 7ed0ca48ec20eef88975aae7883d7691dceeb863 Mon Sep 17 00:00:00 2001
From: Tania Allard <taniar.allard@gmail.com>
Date: Tue, 3 Sep 2024 23:20:52 +0100
Subject: [PATCH] BUG - GH action workflows fixes (#1970)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are a couple of fixes in this PR:

1. The publish action has been failing due to the permissions needed by
the coverage action (see
https://github.com/pydata/pydata-sphinx-theme/actions/runs/10659690328/workflow).
This should add the missing permissions for that specific workflow -
note this is needed as when the workflow is not triggered from a Pull
Request then the coverage data is pushed to a branch in the repo (but
the main CI workflow still needs PR permissions 🤷🏽‍♀️, permissions are
weird).
2. There is a breaking change in the `upload-artifact` action which is
making our workflows fail now
---
 .github/workflows/CI.yml      | 7 ++++---
 .github/workflows/publish.yml | 4 ++++
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 0eef947b2..a7da7541f 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -91,6 +91,7 @@ jobs:
           name: coverage-data-${{ matrix.python-version }}
           path: .coverage
           if-no-files-found: ignore
+          include-hidden-files: true
 
   # Only run accessibility tests on the latest Python version (3.12) and Ubuntu
   a11y-tests:
@@ -178,9 +179,11 @@ jobs:
           runs: 3 # Multiple runs to reduce variance
 
   coverage:
-    name: "check coverage"
+    name: "Check coverage"
     needs: run-pytest
     runs-on: ubuntu-latest
+    # avoid running this on schedule, releases, or workflow_call
+    if: github.event.workflow_run.event != 'schedule' && github.event.workflow_run.event != 'release' && github.event.workflow_run.event != 'workflow_call'
     permissions:
       contents: write
       pull-requests: write
@@ -221,8 +224,6 @@ jobs:
       - name: "Coverage comment 💬"
         uses: py-cov-action/python-coverage-comment-action@v3
         id: coverage_comment
-        # avoid running this on schedule or releases
-        if: github.event.workflow_run.event != 'schedule' && github.event.workflow_run.event != 'release'
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f0f2999bc..edfbfc440 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -20,6 +20,10 @@ jobs:
   # calls our general CI workflow (tests, build docs, etc.)
   tests:
     uses: ./.github/workflows/CI.yml
+    # needed for the coverage action
+    permissions:
+      contents: write
+      pull-requests: write
 
   build-package:
     name: "Build & verify PST package"