feat: disclaimer

Author: lucassabreu

.github/workflows/summary-example.yml

@@ -0,0 +1,21 @@
+name: example of summary
+on:
+  pull_request:
+
+jobs:
+  build:
+    name: example of workflow
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@master
+
+      - name: clover file to comment (clover.example.base.xml)
+        uses: ./.
+        with:
+          dir-prefix: /var/www/html
+          file: clover.example.base.xml
+          base-file: clover.example.xml
+          chart-size: 75
+          only-with-cover: true
+          signature: "summary example"

CHANGELOG.md

@@ -6,6 +6,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- explanation about forks and token permissions with them.
+
 ### Changed
 
 - improving error reporting for debugging purposes

README.md

@@ -155,10 +155,25 @@ jobs:
           base-file: tests/base/coverage.xml
 ```
 
+Restrictions on Forks
+---------------------
+
+Github Actions [imposes higher Restrictions on workflows triggered from forks in public repositories][fork],
+where the default token generated will have only read permissions.
+
+Because of that when this Action is run on pull requests from forks no comment will be created with the
+coverage report, instead the report will only be shown at the steps summary.
+
+![example of step summary with the report](./assets/summary-example.png)
+
+If comments on pull request from forks are required for your workflow a [PAT](pat) can be used, but be aware
+that doing that may open the owner of the PAT to the malicious intentions of the internet.
+
 [CHANGELOG](CHANGELOG.md)
 ---------
 
 [danhunsaker/clover-reporter-action]: https://github.com/danhunsaker/clover-reporter-action
 [pat]: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens
 [lang]: https://developer.mozilla.org/pt-BR/docs/Web/JavaScript/Reference/Global_Objects/Intl#argumento_locales
 [default-token]: https://docs.github.com/en/actions/security-guides/automatic-token-authentication
+[fork]: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token