Fix workflow_run coverage wiring

- Pass run-id/github-token so download-artifact reaches the CI run
- Pipe PR number through pr-number.txt (workflow_run.pull_requests is
  empty for fork PRs)
- Pass issue-number explicitly to the comment action
- Gate coverage job on pull_request event + successful CI conclusion
- Restore COVERAGE_PYTHON env var; cap artifact retention at 1 day

Author: nx10

.github/workflows/ci.yaml

@@ -11,6 +11,7 @@ on:
 
 env:
   UV_FROZEN: true
+  COVERAGE_PYTHON: "3.12"
 
 jobs:
   format:
@@ -66,10 +67,16 @@ jobs:
             pytest-cloud.xml \
             pytest.xml
 
+      - name: Record PR number
+        if: github.event_name == 'pull_request' && matrix.python-version == env.COVERAGE_PYTHON
+        run: echo "${{ github.event.number }}" > pr-number.txt
+
       - uses: actions/upload-artifact@v7
-        if: github.event_name == 'pull_request' && matrix.python-version == '3.12'
+        if: github.event_name == 'pull_request' && matrix.python-version == env.COVERAGE_PYTHON
         with:
-          name: coverage-${{ github.event.number }}
+          name: coverage
+          retention-days: 1
           path: |
             coverage.xml
             pytest.xml
+            pr-number.txt

.github/workflows/coverage.yaml

@@ -7,16 +7,27 @@ on:
 
 permissions:
   pull-requests: write
+  actions: read
 
 jobs:
   coverage:
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/download-artifact@v8
         with:
-          name: coverage-${{ github.event.workflow_run.pull_requests[0].number }}
+          name: coverage
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: pr
+        run: echo "number=$(cat pr-number.txt)" >> "$GITHUB_OUTPUT"
+
       - name: Pytest coverage comment
         uses: MishaKav/pytest-coverage-comment@v1
         with:
+          issue-number: ${{ steps.pr.outputs.number }}
           pytest-xml-coverage-path: ./coverage.xml
           junitxml-path: ./pytest.xml