🐛 fix(ci): a skipped coverage upload failed the gate on every fork PR

[nstarman]

CI Pass has been failing on every pull request from a fork, with all seven real jobs green:

📝 upload-coverage-python → ⬜ skipped [required to succeed]

Why

upload-coverage-python needs code-quality: write, which a fork's token does not carry, so it is correctly gated:

if: ${{ ... && (github.event_name != 'pull_request'
                || github.event.pull_request.head.repo.full_name == github.repository) }}

But it is listed unconditionally in the gate's needs, and alls-green counts a skipped required job as a failure. The two are individually right and wrong together.

Nothing was wrong with the coverage job or with the PRs. #812 merged showing FAILURE on a run where format, smoke, tests_linux, tests_nonlinux, tests_subprocess, check_oldest and docs all passed, and #813 is sitting on the same red now. That is the real cost here: a gate that is always red stops carrying information about the runs that do matter, and a genuine failure would look identical.

The fix

allowed-skips: upload-coverage-python — one line, and it excuses the skip and nothing else.

The job stays in needs, so on a same-repo push, where it does run, a failure still fails the gate. allowed-failures was the wrong knob for exactly that reason: it would have excused a genuine upload failure too. Verified against the action's action.yml at the pinned SHA rather than from memory — both inputs exist and the semantics differ as described.

The other seven required jobs carry no if:, so upload-coverage-python is the only one that can skip; this is the whole fix, not one instance of a pattern.

Verification

prek run --all-files clean, including the workflow-schema hook. Parsed the result to confirm the gate still requires the job while excusing only its skip, and that no allowed-failures crept in. The behaviour this changes is only observable in CI: this PR is itself a fork PR, so its own CI Pass is the test — red before, green after.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The change is narrowly scoped, matches the stated CI failure mode, and uses a supported allowed-skips input on the pinned alls-green action version.

Pull request overview

Fixes the CI Pass gate incorrectly failing on fork pull requests when upload-coverage-python is intentionally skipped due to missing code-quality: write permissions on fork tokens.

Changes:

• Configures the re-actors/alls-green gate to treat upload-coverage-python as an allowed skip (while still failing the gate if that job runs and fails on same-repo PRs/pushes).

File summaries

File	Description
.github/workflows/ci.yml	Allows the gate to accept a skipped upload-coverage-python job, preventing false-red CI on fork PRs while keeping same-repo enforcement intact.

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.91%. Comparing base (66d7489) to head (514aaed).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #815   +/-   ##
=======================================
  Coverage   96.91%   96.91%           
=======================================
  Files         272      272           
  Lines        9433     9433           
=======================================
  Hits         9142     9142           
  Misses        291      291           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.