CI: test reporter fails on pull requests from forks (Resource not accessible by integration)

[jbogard]

Summary

The CI workflow (.github/workflows/ci.yml) will fail on pull requests opened from forks, even when all tests pass, because the Report Test Results step can't get a writable token on forked-PR runs.

This was diagnosed in the AutoMapper repo (LuckyPennySoftware/AutoMapper#4642); MediatR's CI uses the same dorny/test-reporter pattern and is affected the same way.

Symptom

Error: HttpError: Resource not accessible by integration

from the Report Test Results step:

- name: Report Test Results
  uses: dorny/test-reporter@v1.9.1
  if: success() || failure()
  with:
    name: Test Results (Windows)
    path: '**/TestResults/**/*.trx'
    reporter: dotnet-trx

Cause

dorny/test-reporter calls the Checks API (POST /repos/.../check-runs) to publish results, which requires checks: write. The workflow declares permissions: checks: write, but GitHub forcibly downgrades GITHUB_TOKEN to read-only for pull_request runs triggered from a fork (so untrusted PR code can't write to the base repo). The API responds with 403 "Resource not accessible by integration" ("integration" = the GitHub Actions app), and the action's default fail-on-error: true fails the whole job — even though the tests passed.

Note: MediatR's ci.yml has no Azure-login step, so (unlike AutoMapper) only the test-reporter step is affected here. Push to MyGet is already correctly gated to main.

Suggested fix

• Minimal: add continue-on-error: true to the Report Test Results step so report publishing is best-effort and never fails the build (the Build and Test step remains the source of truth for pass/fail).
• Fuller (optional): adopt the workflow_run pattern — the pull_request build uploads the .trx files as an artifact, and a separate workflow_run-triggered workflow running in the base-repo context (with checks: write) publishes the report. This gives fork PRs real inline test reports instead of skipping them.

Reference

Diagnosis and stop-gap fix: LuckyPennySoftware/AutoMapper#4642 (and PR LuckyPennySoftware/AutoMapper#4634).