`pull_request_target` trigger is treated as `push` rather than a pull request

[alexbatashev]

Coveralls GitHub Action requires a secret token, that is only available for pull requests in two cases:

1. Pull request was open from the same repository
2. GitHub Action workflow was triggered by pull_request_target event.

The latter, however, appears to be completely ignored by this action. I do not receive a PR comment, and the UI is showing that the target commit is my main branch HEAD.

Apparently, Coveralls uses $GITHUB_SHA to identify the commit. Which in case of pull_request_target equals to the main commit, not the PR commit. I tried fixing that with the following snippet:

    - id: sha
      run: echo "SHA=$(git rev-parse HEAD)" > $GITHUB_OUTPUT
    - name: Coveralls
      uses: coverallsapp/github-action@v2
      with:
        git-commit: ${{ steps.sha.outputs.SHA }}

but the commit hash on the Coveralls UI remains the same, and the comparison fails.

Here's an example of a PR: perf-toolbox/tir#29
And whatever was generated for that event: https://coveralls.io/builds/67039590
Even though I delete a bunch of tests, the Coveralls shows that the PR introduced no changes. Only after I commit that PR, I can see my updated coverage info.