fix: revert checkout ref pin to avoid running fork code in privileged context

The workflow_run trigger has access to secrets.CODECOV_TOKEN. Checking out workflow_run.head_sha would let fork PRs control code executed via .github/actions/setup-frontend (pnpm install). The default checkout (default branch) is safe, and --ignore-errors source already tolerates source file mismatches in genhtml. Addresses review feedback: https://github.com/Comfy-Org/ComfyUI_frontend/pull/11381#discussion_r3107765436
fix: harden e2e coverage workflow and fix GH Pages deploy
2026-05-03 20:51:58 +00:00 · 2026-05-01 21:03:18 -07:00 · 2026-05-01 21:03:18 -07:00
1 changed files with 7 additions and 3 deletions
--- a/.github/workflows/ci-tests-e2e-coverage.yaml
+++ b/.github/workflows/ci-tests-e2e-coverage.yaml
@@ -104,14 +104,16 @@ jobs:
          if [ ! -s coverage/playwright/coverage.lcov ]; then
            echo "No coverage data; generating placeholder report."
            mkdir -p coverage/html
-            echo '<html><body><h1>No E2E coverage data available for this run.</h1></body></html>' > coverage/html/index.html
+            WORKFLOW_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}"
+            echo "<html><body><h1>No E2E coverage data available for this run.</h1><p><a href=\"${WORKFLOW_URL}\">View workflow run</a></p></body></html>" > coverage/html/index.html
            exit 0
          fi
          genhtml coverage/playwright/coverage.lcov \
            -o coverage/html \
            --title "ComfyUI E2E Coverage" \
            --no-function-coverage \
-            --precision 1
+            --precision 1 \
+            --ignore-errors source

      - name: Upload HTML report artifact
        uses: actions/upload-artifact@v6
@@ -122,7 +124,9 @@ jobs:

  deploy:
    needs: merge
-    if: github.event.workflow_run.head_branch == 'main'
+    if: >
+      github.event.workflow_run.head_branch == 'main' &&
+      github.event.workflow_run.event == 'push'
    runs-on: ubuntu-latest
    permissions:
      pages: write