From d883acc3eec73a45ac6456aa6cb7234f784f65cc Mon Sep 17 00:00:00 2001
From: Eduardo Speroni <edusperoni@gmail.com>
Date: Wed, 19 Aug 2026 21:59:41 -0300
Subject: [PATCH] ci: report test results inline instead of via a separate
 workflow

The workflow_run-based Test Report workflow existed only because fork
PRs get a read-only GITHUB_TOKEN, so the test job could not post a
check run. But the JUnit XML it renders is produced by the untrusted
PR run itself, so the resulting check carries no integrity, and the
report workflow held the repo's only write-scoped token that processes
untrusted input.

Replace it with mikepenz/action-junit-report in annotate_only mode
directly in the test jobs: it reports through workflow commands and
the step summary, which work with a read-only token, including from
fork PRs. The results artifact upload stays for debugging.
---
 .github/workflows/npm_release.yml  |  7 +++++++
 .github/workflows/pull_request.yml |  9 +++++++++
 .github/workflows/test_report.yml  | 22 ----------------------
 3 files changed, 16 insertions(+), 22 deletions(-)
 delete mode 100644 .github/workflows/test_report.yml

diff --git a/.github/workflows/npm_release.yml b/.github/workflows/npm_release.yml
index 4be63861d..1b2f13a16 100644
--- a/.github/workflows/npm_release.yml
+++ b/.github/workflows/npm_release.yml
@@ -210,6 +210,13 @@ jobs:
         with:
           name: android-unit-test-results
           path: test-app/dist/android_unit_test_results.xml
+      - name: Test report summary
+        if: ${{ !cancelled() }}
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6.4.2
+        with:
+          report_paths: test-app/dist/android_unit_test_results.xml
+          annotate_only: true
+          detailed_summary: true
   publish:
     runs-on: ubuntu-latest
     environment: npm-publish
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index c4a2ad4f3..b9d73a4a9 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -182,3 +182,12 @@ jobs:
         with:
           name: android-unit-test-results
           path: test-app/dist/android_unit_test_results.xml
+      - name: Test report summary
+        if: ${{ !cancelled() }}
+        # annotate_only keeps this usable from fork PRs: it reports via workflow
+        # commands and the step summary, so no checks:write token is needed
+        uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 # v6.4.2
+        with:
+          report_paths: test-app/dist/android_unit_test_results.xml
+          annotate_only: true
+          detailed_summary: true
diff --git a/.github/workflows/test_report.yml b/.github/workflows/test_report.yml
deleted file mode 100644
index defe05e91..000000000
--- a/.github/workflows/test_report.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: "Test Report"
-on:
-  workflow_run:
-    workflows:
-      - Pull Request
-      - NPM Release
-    types:
-      - completed
-permissions:
-  contents: read
-  actions: read
-  checks: write
-jobs:
-  report:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        with:
-          name: Android Runtime Tests
-          artifact: android-unit-test-results # artifact name
-          path: android_unit_test_results.xml
-          reporter: jest-junit # Format of test results