ci: Allow reporting of coverage on PRs from forks (#1622)

* Run CI on push events to master by default, but on any branch on a push event if the commit message contains '[ci all]'
   - Results in a skip of push event tests on PRs by default
* Run CI on pull_request events to master
* Allow reporting of test coverage to Codecov on pull_request events from forks
   - Use fact that secrets.CODECOV_TOKEN is not required for public repos
   - c.f. https://github.com/codecov/codecov-action/blob/260aa3b4b2f265b8578bc0e721e33ebf8ff53313/README.md
   - On all events, except schedule, from maintainers, upload coverage to codecov.io faster using the CODECOV_TOKEN secret
   - On pull_request events from contributor forks, upload coverage to codecov.io without using CODECOV_TOKEN secret

.github/workflows/ci.yml

@@ -3,6 +3,8 @@ name: CI/CD
 on:
   push:
   pull_request:
+    branches:
+    - master
   # Run daily at 0:01 UTC
   schedule:
   - cron:  '1 0 * * *'
@@ -12,6 +14,11 @@ jobs:
   test:
 
     runs-on: ${{ matrix.os }}
+    # On push events run the CI only on master by default, but run on any branch if the commit message contains '[ci all]'
+    if: >-
+      github.event_name != 'push'
+      || (github.event_name == 'push' && github.ref == 'refs/heads/master')
+      || (github.event_name == 'push' && github.ref != 'refs/heads/master' && contains(github.event.head_commit.message, '[ci all]'))
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest]
@@ -24,37 +31,62 @@ jobs:
 
     steps:
     - uses: actions/checkout@v2
+
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v2
       with:
         python-version: ${{ matrix.python-version }}
+
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip setuptools wheel
         python -m pip install --upgrade --editable .[test]
+
     - name: List installed Python packages
-      run: |
-        python -m pip list
+      run: python -m pip list
+
     - name: Test with pytest
       run: |
         python -m pytest -r sx --ignore tests/benchmarks/ --ignore tests/contrib --ignore tests/test_notebooks.py
-    - name: Report core project coverage with Codecov
-      if: github.event_name == 'push' && matrix.python-version == 3.9 && matrix.os == 'ubuntu-latest'
+
+    - name: Report core project coverage with Codecov (maintainers)
+      # Run on all events except schedule if PR comes from maintainers
+      if: github.repository == 'scikit-hep/pyhf' && github.event_name != 'schedule' && matrix.python-version == 3.9 && matrix.os == 'ubuntu-latest'
       uses: codecov/codecov-action@v1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         file: ./coverage.xml
         flags: unittests
+
+    - name: Report core project coverage with Codecov (contributors)
+      # Run on pull_request events if PR comes from contributor fork
+      if: github.repository != 'scikit-hep/pyhf' && github.event_name == 'pull_request' && matrix.python-version == 3.9 && matrix.os == 'ubuntu-latest'
+      uses: codecov/codecov-action@v1
+      with:
+        file: ./coverage.xml
+        flags: unittests
+
     - name: Test Contrib module with pytest
       run: |
         python -m pytest -r sx tests/contrib --mpl --mpl-baseline-path tests/contrib/baseline
-    - name: Report contrib coverage with Codecov
-      if: github.event_name == 'push' && matrix.python-version == 3.9 && matrix.os == 'ubuntu-latest'
+
+    - name: Report contrib coverage with Codecov (maintainers)
+      # Run on all events except schedule if PR comes from maintainers
+      if: github.repository == 'scikit-hep/pyhf' && github.event_name != 'schedule' && matrix.python-version == 3.9 && matrix.os == 'ubuntu-latest'
       uses: codecov/codecov-action@v1
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         file: ./coverage.xml
         flags: contrib
+
+    - name: Report contrib coverage with Codecov (contributors)
+      # Run on pull_request events if PR comes from contributor fork
+      if: github.repository != 'scikit-hep/pyhf' && github.event_name == 'pull_request' && matrix.python-version == 3.9 && matrix.os == 'ubuntu-latest'
+      uses: codecov/codecov-action@v1
+      with:
+        file: ./coverage.xml
+        flags: contrib
+
     - name: Run benchmarks
       if: github.event_name == 'schedule' && matrix.python-version == 3.9
       run: |