enable coverage for PRs (#17204)

Codecov numbers should be stable enough now to enable them for PRs as
well.

.github/workflows/ci.yml

@@ -393,7 +393,7 @@ jobs:
       test-name: ${{ matrix.test-suite.name || matrix.test-suite.command }} on ${{ matrix.platform }}/${{ matrix.version-set.name }}
       test-command: ${{ matrix.test-suite.command }}
       is-integration-test: true
-      enable-coverage: ${{ inputs.enable-coverage }}
+      enable-coverage: false
       test-retries: ${{ inputs.test-retries }}
       # require-build: false # TODO, remove ${{ matrix.require-build || false }}
 
@@ -420,7 +420,7 @@ jobs:
       test-name: ${{ matrix.test-suite.name || matrix.test-suite.command }} on ${{ matrix.platform }}/${{ matrix.version-set.name }}
       test-command: ${{ matrix.test-suite.command }}
       is-integration-test: true
-      enable-coverage: ${{ inputs.enable-coverage }}
+      enable-coverage: false
       test-retries: ${{ inputs.test-retries }}
       # require-build: false # TODO, remove ${{ matrix.require-build || false }}
 
@@ -449,7 +449,7 @@ jobs:
           ls -lhR test-results
           find test-results -mindepth 1 -name '*.json' -mtime +7 -delete
   test-collect-coverage:
-    needs: [unit-test, integration-test, acceptance-test-macos]
+    needs: [unit-test, integration-test]
     if: ${{ inputs.enable-coverage }}
     runs-on: ubuntu-latest
     steps:
@@ -473,6 +473,13 @@ jobs:
           pattern: coverage-*
           merge-multiple: true
           path: coverage
+      # For PRs we need to set the merge base manually, otherwise it is sometimes incorrect.  See https://github.com/pulumi/pulumi/pull/17204#issuecomment-2405599310
+      - name: Set codecov PR base
+        if: github.event_name == 'pull_request'
+        run: |
+          curl -Os https://cli.codecov.io/latest/linux/codecov
+          sudo chmod +x codecov
+          ./codecov pr-base-picking --base-sha "$(git merge-base origin/master HEAD)" --pr ${{ github.event.number }} --slug pulumi/pulumi --token ${{ secrets.CODECOV_TOKEN }} --service github
       - name: Upload code coverage
         uses: codecov/codecov-action@v4
         with:

.github/workflows/on-pr.yml

@@ -14,7 +14,7 @@ on:
       - "sdk/.version"
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.head_ref }}
   cancel-in-progress: true
 
 # The jobs in this workflow are only run on branches. The `on-community-pr.yml` job provides
@@ -28,7 +28,7 @@ jobs:
     permissions:
       contents: read
     with:
-      ref: ${{ github.ref }}
+      ref: ${{ github.head_ref }}
       is-snapshot: true
     secrets: inherit
 
@@ -67,17 +67,12 @@ jobs:
       # To sign artifacts.
       id-token: write
     with:
-      ref: ${{ github.ref }}
+      ref: ${{ github.head_ref }}
       version: ${{ needs.info.outputs.version }}
       lint: true
-      # codegen tests take quite a while to run.
-      # Run them only if ci/test is set,
-      # or if one of the codegen files changed.
-      test-codegen: >- # No newlines or trailing newline.
-        ${{
-          contains(github.event.pull_request.labels.*.name, 'ci/test') ||
-          (needs.inspect.outputs.test-codegen == 'true')
-        }}
+      # codegen tests are not the fastest, but we want to run them
+      # on PR to get correct coverage numbers.
+      test-codegen: true
       test-version-sets: >- # No newlines or trailing newline.
         ${{
           contains(github.event.pull_request.labels.*.name, 'ci/test')
@@ -91,8 +86,7 @@ jobs:
           && 'macos-latest windows-latest'
           || 'windows-latest'
         }}
-      # We'll only upload coverage artifacts with the periodic-coverage cron workflow.
-      enable-coverage: false
+      enable-coverage: true
     secrets: inherit
 
   performance-gate: