feat: move-diff-logic-within-the-plugin

Drop the Vela start.sh entrypoint and run the plugin binary directly
(ENTRYPOINT ["/plugin"]); the diff is now produced in-plugin
(PARAMETER_DIFF_SOURCE=github) or piped on stdin. Also run the coverage
job on fork PRs, tolerating the read-only-token comment 403 via
continue-on-error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 2 people

.github/workflows/pr-coverage.yml

@@ -14,9 +14,10 @@ permissions:
 jobs:
   coverage:
     runs-on: ubuntu-latest
-    # Fork PRs only get a read-only GITHUB_TOKEN (can't comment) and no secrets,
-    # so restrict to same-repo PRs to avoid a guaranteed failure on forks.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Runs on fork PRs too. Fork PRs only get a read-only GITHUB_TOKEN and no
+    # secrets, so the plugin can't post the PR comment there — it just prints
+    # coverage to the job log (the reporter no-ops the comment when the token /
+    # PR context is missing).
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4
@@ -45,6 +46,11 @@ jobs:
         run: docker build -t pr-code-coverage:ci .
 
       - name: Report coverage on changed lines
+        # On fork PRs the GITHUB_TOKEN is read-only: the plugin can read the diff
+        # but the PR-comment POST gets a 403 and errors. Tolerate that on forks so
+        # the run still goes green with coverage printed to the log; same-repo PRs
+        # keep failing loudly on real errors.
+        continue-on-error: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
         env:
           # Fetch the PR diff straight from the GitHub API instead of piping in a
           # local `git diff`. Note the API diff covers ALL changed files, not just
@@ -73,5 +79,4 @@ jobs:
             -e REPOSITORY_NAME \
             -v "${{ github.workspace }}:${{ github.workspace }}" \
             -w "${{ github.workspace }}" \
-            --entrypoint /plugin \
             pr-code-coverage:ci

Dockerfile

@@ -13,5 +13,7 @@ FROM alpine:latest
 COPY --from=builder /go/src/github.com/target/pull-request-code-coverage/bin/plugin /
 RUN apk --no-cache add ca-certificates git bash openssh-client
 WORKDIR /root/
-COPY scripts/start.sh /
-CMD ["/start.sh"]
+# Run the plugin directly. With PARAMETER_DIFF_SOURCE=github it fetches the PR
+# diff from the GitHub API; for the stdin path, pipe a `git diff` into the
+# container (docker run -i ... | git diff ...).
+ENTRYPOINT ["/plugin"]