[Improvement][CI] Replace token with github secrets

[chengshiwen]

What is the purpose of the pull request

Replace token with github secrets

This closes the outdated pr #4102

Brief change log

• Replace CODECOV_TOKEN with github secrets
• Replace SONAR_TOKEN with github secrets

Requirements

The following variables need to be set under the Actions secrets in the Secrets settings page of apache/incubator-dolphinscheduler repository:

• CODECOV_TOKEN
• SONAR_TOKEN

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

[Jave-Chen]

Hi, workflows on pull request events can't read the token of base repository.
Maybe you can work aroud by pull_request_target event.
https://github.blog/2020-08-03-github-actions-improvements-for-fork-and-pull-request-workflows/
https://docs.github.com/en/free-pro-team@latest/actions/reference/events-that-trigger-workflows#pull_request_target

ref: #4102

[codecov-io]

Codecov Report

Merging #4910 (a7f01ce) into dev (a3153b5) will decrease coverage by 0.08%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##                dev    #4910      +/-   ##
============================================
- Coverage     47.01%   46.93%   -0.09%     
+ Complexity     3681     3671      -10     
============================================
  Files           570      570              
  Lines         23941    23941              
  Branches       2757     2757              
============================================
- Hits          11257    11236      -21     
- Misses        11661    11682      +21     
  Partials       1023     1023              

Impacted Files	Coverage Δ	Complexity Δ
...he/dolphinscheduler/remote/utils/ChannelUtils.java	16.66% <0.00%> (-16.67%)	1.00% <0.00%> (ø%)
...lphinscheduler/remote/future/ReleaseSemaphore.java	85.71% <0.00%> (-14.29%)	2.00% <0.00%> (-1.00%)
...er/master/dispatch/host/assign/RandomSelector.java	77.77% <0.00%> (-5.56%)	3.00% <0.00%> (-1.00%)
...inscheduler/remote/handler/NettyClientHandler.java	29.82% <0.00%> (-5.27%)	5.00% <0.00%> (-1.00%)
...er/server/worker/task/AbstractCommandExecutor.java	16.66% <0.00%> (-4.63%)	10.00% <0.00%> (-3.00%)
...e/dolphinscheduler/remote/NettyRemotingClient.java	50.70% <0.00%> (-1.41%)	11.00% <0.00%> (-1.00%)
...olphinscheduler/plugin/alert/email/MailSender.java	72.72% <0.00%> (-1.40%)	19.00% <0.00%> (-1.00%)
...er/master/processor/queue/TaskResponseService.java	71.23% <0.00%> (-1.37%)	8.00% <0.00%> (-1.00%)
...pache/dolphinscheduler/remote/command/Command.java	60.60% <0.00%> (ø)	11.00% <0.00%> (-1.00%)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a3153b5...a7f01ce. Read the comment docs.

[CalvinKirs]

hi, any progress?

[chengshiwen]

hi, any progress?

I found a trigger event pull_request_target which maybe resolves the problem of accessing the base repository's secrets from a forked repository. The event pull_request_target has been used in some opensource repositories. I have tested it for a few hours last weekend, but it hasn’t been successful yet. I’ll go further and solve it next.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity for 120 days. It will be closed in 7 days if no further activity occurs.

[kezhenxu94]

No update for 1+ year, closing, please feel free to reopen if you want to continue