chore(ci): skip coverage upload for external fork PRs

External contributors' PRs fail when uploading coverage reports
because GitHub Actions doesn't expose secrets to workflows triggered
by forks (security measure). This adds a conditional to skip the
coverage job for external PRs while still running tests.

Coverage will still run for:
- Dependabot PRs (same repository)
- Internal team PRs (same repository)
- Pushes to master (post-merge)

External contributors will see their tests pass successfully
without the coverage upload step.

Author: nanotaboada

.github/workflows/python-app.yml

@@ -79,6 +79,9 @@ jobs:
   coverage:
     needs: test
     runs-on: ubuntu-latest
+    # Only run coverage for PRs from the same repository (not forks)
+    # This ensures secrets are available for Codecov and Codacy
+    if: github.event.pull_request.head.repo.full_name == github.repository || github.event_name == 'push'
     strategy:
       matrix:
         service: [codecov, codacy]
@@ -107,8 +110,8 @@ jobs:
 
   container:
     needs: coverage
-    runs-on: ubuntu-latest
     if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+    runs-on: ubuntu-latest
 
     permissions:
       contents: read