codecov.yml

name: Codecov for pull requests

on:
  workflow_run:
    workflows:
      - Continuous Integration
    types:
      - completed

permissions:
  contents: read

jobs:
  coverage:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.workflow_run.head_sha }}
          # Make sure that history is available to Codecov
          fetch-depth: 0

      - name: Install pnpm package manager
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0

      - name: Setup Node.js version and cache
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
          node-version-file: .nvmrc

      - name: Check for known security issues with npm packages
        run: |
          echo "Auditing npm dependencies before installing them. For more information, see: https://nldesignsystem.nl/pnpm-audit"
          pnpm audit --audit-level critical

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Download coverage-report artifact
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: coverage-report
          # Needed to download an artifact created in a different workflow
          github-token: ${{ github.token }}
          run-id: ${{ github.event.workflow_run.id }}

      - name: Upload coverage to codecov.io
        id: codecov-action
        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
        with:
          fail_ci_if_error: true
          override_commit: ${{ github.event.workflow_run.head_sha }}
          override_pr: ${{ github.event.workflow_run.pull_requests[0].number }}
          token: ${{ secrets.CODECOV_TOKEN }}