Add CSV coverage PR commenter

[tamasvajk]

This PR adds a github action which runs on PRs. It compares the merge commit of the PR and the head of the base branch. On both commits the CSV reports are generated, and the differences are added as a comment on the PR. The workflow is split into two parts: on: pull_request to generate the reports and on: workflow_run to compare them and add a PR comment.

The PR is based on #6008, so only the last commit(s) should be reviewed.

I've tested the commenting functionality in https://github.com/dsp-testing/codeql-csv-coverage-pr-commenter/pull/1.

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the CSV coverage reports. The generated reports are available in the artifacts of this workflow run. The following differences were found:

java

Generated files are not matching for java

• Mismatch in flow-model-coverage-java.rst:

-    `Spring <https://spring.io/>`_,``org.springframework.*``,30,,14,,,,,14,,
+    `Spring <https://spring.io/>`_,``org.springframework.*``,29,,14,,,,,14,,
-    Totals,,85,1233,121,13,6,6,,33,1,2
+    Totals,,84,1233,121,13,6,6,,33,1,2

• Mismatch in flow-model-coverage-java.csv:

- org.springframework.security.web.savedrequest,,7,,,,,,,,,,,,,7,,
+ org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,6,,

[yo-h]

Minor changes suggested below (add highlighting, and change wording from "mismatch" to "changes" to avoid giving the impression that there is something wrong).

---

⚠️ The head of this PR and the base branch were compared for differences in framework coverage. The generated reports are available in the artifacts of this workflow run. The following differences were found:

java

Generated file changes for java

• Changes to flow-model-coverage-java.rst:

-    `Spring <https://spring.io/>`_,``org.springframework.*``,30,,14,,,,,14,,
+    `Spring <https://spring.io/>`_,``org.springframework.*``,29,,14,,,,,14,,
-    Totals,,85,1233,121,13,6,6,,33,1,2
+    Totals,,84,1233,121,13,6,6,,33,1,2

• Changes to flow-model-coverage-java.csv:

- org.springframework.security.web.savedrequest,,7,,,,,,,,,,,,,7,,
+ org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,6,,

[github-actions]

⚠️ The head of this PR and the base branch were compared for differences in the framework coverage reports. The generated reports are available in the artifacts of this workflow run. The differences will be picked up by the nightly job after the PR gets merged. The following differences were found:

java

Generated file changes for java

• Changes to flow-model-coverage-java.rst:

-    `Spring <https://spring.io/>`_,``org.springframework.*``,30,,14,,,,,14,,
+    `Spring <https://spring.io/>`_,``org.springframework.*``,29,,14,,,,,14,,
-    Totals,,85,1233,121,13,6,6,,33,1,2
+    Totals,,84,1233,121,13,6,6,,33,1,2

• Changes to flow-model-coverage-java.csv:

- org.springframework.security.web.savedrequest,,7,,,,,,,,,,,,,7,,
+ org.springframework.security.web.savedrequest,,6,,,,,,,,,,,,,6,,

[adityasharad]

Nice! Some suggestions on the details of the Actions workflows, but the general setup looks good.

[tamasvajk]

Thanks @adityasharad for the code review. Here's a PR comment generated after the fixes. Also, here's the latest timeseries run.

[yo-h]

There is lots of commented-out code above this line. Should that be removed?

[tamasvajk]

Yes, I'll remove these, and some of it will come back as part of the followup work on the automatic PR creation with the changes in main.

[adityasharad]

Actions code looks good, only minor suggestions remaining.