ci: Fix permissions to run GHA on PR from forks

.github/CODEOWNERS

@@ -0,0 +1 @@
+/.github/ @thomass-dev @rouk1 @augustebaum

.github/workflows/backend.yml

@@ -0,0 +1,59 @@
+# THIS
+# IS
+# DOCUMENTATION
+# REUSABLE WORKFLOW
+
+name: Backend
+
+on: [workflow_call]
+
+defaults:
+  run:
+    shell: "bash"
+
+jobs:
+  test-skore:
+    strategy:
+      fail-fast: true
+      matrix:
+        os: ["ubuntu-latest", "windows-latest"]
+        python: ["3.9", "3.10", "3.11", "3.12"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+          cache: "pip"
+      - name: Setup
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install --upgrade pre-commit
+          python -m pip install --upgrade build
+      - name: Lint
+        working-directory: skore/
+        run: pre-commit run --all-files ruff
+      - name: Build
+        working-directory: skore/
+        run: python -m build
+      - name: Install
+        working-directory: skore/
+        run: wheel=(dist/*.whl); python -m pip install "${wheel}[test]"
+      - name: Test without coverage
+        if: matrix.os != 'ubuntu-latest' ||  matrix.python != '3.12'
+        timeout-minutes: 10
+        working-directory: skore/
+        run: python -m pytest --no-cov src/ tests/
+      - name: Test with coverage
+        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.12'
+        timeout-minutes: 10
+        working-directory: skore/
+        run: |
+          mkdir coverage
+          python -m pytest --junitxml=coverage/coverage.xml --cov=skore src/ tests/ | tee coverage/coverage.txt
+      - name: Upload coverage reports
+        if: matrix.os == 'ubuntu-latest' && matrix.python == '3.12'
+        uses: actions/upload-artifact@v4
+        with:
+          name: backend-coverage
+          path: skore/coverage/

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
               - 'skore/tests/**'
               - 'skore/pyproject.toml'
               - 'skore/requirements*.txt'
-              - '.github/workflows/skore.yml'
+              - '.github/workflows/skore-test.yml'
             skore-ui:
               - 'skore-ui/**'
               - '.github/workflows/skore-ui.yml'
@@ -42,18 +42,16 @@ jobs:
   lint-and-test-skore:
     needs: [lint-all-files, changes]
     if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && needs.changes.outputs.skore == 'true') }}
-    uses: ./.github/workflows/skore.yml
+    uses: ./.github/workflows/skore-test.yml
     permissions:
       contents: read
-      pull-requests: write
 
   lint-and-test-skore-ui:
     needs: [lint-all-files, changes]
     if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'pull_request' && needs.changes.outputs.skore-ui == 'true') }}
     uses: ./.github/workflows/skore-ui.yml
     permissions:
       contents: read
-      pull-requests: write
 
   ci-all-green:
     needs:

.github/workflows/skore-ui.yml → .github/workflows/frontend.yml

@@ -1,11 +1,15 @@
-name: Reusable skore-ui workflow
+# THIS
+# IS
+# DOCUMENTATION
+# REUSABLE WORKFLOW
+
+name: Frontend
 
 on: [workflow_call]
 
 defaults:
   run:
     shell: 'bash'
-    working-directory: './skore-ui'
 
 jobs:
   lint-skore-ui:
@@ -18,6 +22,7 @@ jobs:
           cache: 'npm'
           cache-dependency-path: skore-ui/package-lock.json
       - name: Lint skore-ui
+        working-directory: skore-ui/
         run: |
           npm install
           npm run type-check
@@ -27,7 +32,6 @@ jobs:
 
   test-skore-ui:
     runs-on: ubuntu-latest
-    needs: lint-skore-ui
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -36,19 +40,18 @@ jobs:
           cache: 'npm'
           cache-dependency-path: skore-ui/package-lock.json
       - name: Test skore-ui
+        working-directory: skore-ui/
         run: |
           npm install
           npm run test:unit:coverage
-      - name: Report coverage
-        if: always()
-        uses: davelosert/vitest-coverage-report-action@v2
+      - name: Upload coverage reports
+        uses: actions/upload-artifact@v4
         with:
-          working-directory: ./skore-ui
-          pr-number: ${{ github.event.number }}
+          name: frontend-coverage
+          path: skore-ui/coverage/
 
   build-skore-ui:
     runs-on: ubuntu-latest
-    needs: test-skore-ui
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -57,6 +60,7 @@ jobs:
           cache: 'npm'
           cache-dependency-path: skore-ui/package-lock.json
       - name: Build skore-ui
+        working-directory: skore-ui/
         run: |
           npm install
           npm run build

.github/workflows/add-pr-assignee.yml → .github/workflows/pr-add-assignee.yml

@@ -1,7 +1,7 @@
 name: Add PR assignee
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened]
 
 jobs:

.github/workflows/pr-display-backend-coverage.yml

@@ -0,0 +1,32 @@
+name: send backend coverage
+
+on:
+  workflow_run:
+    workflows: [Reusable skore workflow]
+    types: [completed]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: write
+
+jobs:
+  send-coverage-message:
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: Download coverage reports
+        uses: actions/download-artifact@v4
+        with:
+          name: backend-coverage
+          path: coverage/
+      - name: Send
+        uses: MishaKav/pytest-coverage-comment@main
+        with:
+          pytest-coverage-path: coverage/coverage.txt
+          junitxml-path: coverage/coverage.xml
+          title: pytest coverage report

.github/workflows/pr-display-frontend-coverage.yml

@@ -0,0 +1,5 @@
+      # - name: Report coverage
+      #   uses: davelosert/vitest-coverage-report-action@v2
+      #   with:
+      #     working-directory: ./skore-ui
+      #     pr-number: ${{ github.event.number }}

.github/workflows/release.yml

@@ -1,3 +1,7 @@
+# THIS
+# IS
+# DOCUMENTATION
+
 name: Release
 
 on: