[PM-7025] include check-run in workflows where secrets are used

[bwdil]

Type of change

GitHub workflows

- [ ] Bug fix
- [ ] New feature development
- [ ] Tech debt (refactoring, code cleanup, dependency upgrades, etc)
- [ ] Build/deploy pipeline (DevOps)
- [ X ] Other

Objective

As part of our organization-wide effort to secure bw code repos, a change to include check-run in workflows where secrets are used is required.

Code changes

Incremental change to existing workflows

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 27.76%. Comparing base (4ae208f) to head (bb13e5d).

❗ Current head bb13e5d differs from pull request most recent head 3ac7bb8. Consider uploading reports for the commit 3ac7bb8 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9135      +/-   ##
==========================================
- Coverage   27.76%   27.76%   -0.01%     
==========================================
  Files        2421     2421              
  Lines       70098    70097       -1     
  Branches    13059    13059              
==========================================
- Hits        19463    19462       -1     
  Misses      49123    49123              
  Partials     1512     1512              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

Checkmarx One – Scan Summary & Details – 522a9486-0e53-4118-b690-9ffa65f032ec

No New Or Fixed Issues Found

[withinfocus]

This PR wouldn't be necessary as-is; when you look at all the other workflows in this repo it might be. I would like to see one PR for the entire repo, as is relevant.

[withinfocus]

❌ You have to replace the above pull_request_target with this.

[withinfocus]

❌ This is expanding the work surface but touches on something Oscar was bringing up -- needing secrets, and when. You'll see below that the secret reference is only relevant when on non-PR builds, so this check isn't even necessary.

[bwdil]

ok, in that case we don't need check-run for this one.