Why can't contributors open our CI artifacts?

Artifacts are a zip behind the CI provider's auth, and on many providers a first-time or fork-based contributor either can't download them or gets a file that renders blank because the HTML lost its sibling assets. A public URL removes both barriers.

Can the report be public while the repo stays private?

Yes — visibility is set per report, independently of anything else. A private project can publish one public benchmark page without exposing the repository.

Does a reader need an account?

No. A public report opens in any browser with no account, and viewers are never charged — pricing is per publisher, so an audience of thousands costs the same as an audience of one.

How do we avoid a new link on every run?

Create one report per purpose — coverage on main, the nightly benchmark — and publish revisions to it. The README badge and the docs link then point at one stable address whose history shows the trend.

Is it safe to publish reports from fork PRs?

Only with the same care you'd use for any secret in a fork workflow. Most providers deliberately withhold secrets from fork-triggered runs; publish from a trusted workflow that runs after review rather than handing a token to untrusted code.

Reports contributors can open

Open source runs on drive-by contributors, and drive-by contributors hit a wall that maintainers stopped noticing years ago: the CI artifact is not readable by them. It's a zip behind the provider's auth, the download may require permissions a first-time contributor doesn't have, and when they do get it, the HTML often opens blank because it was separated from its assets.

So they ask in the PR thread what the coverage change was, and you paste a number from your own screen. That's the loop worth deleting.

Publish it, link it from the PR

One step in the workflow turns the report into a URL anyone can open — no account, no download, no login wall:

GitHub Actions · GitLab CI · CircleCI · Travis CI — and the rest at /ci.

The reports that matter most to contributors:

Coverage · lcov · Istanbul · JaCoCo · Cobertura · SimpleCov · Rust coverage
Benchmarks · Criterion · JMH
Bundle size · source-map-explorer · rollup-visualizer
Lint and quality: ESLint · Ruff · Clippy-adjacent Rust output · SonarQube
Docs builds: see for technical writers

Publish the whole output folder. A coverage report is one entry page plus a file tree; sending only index.html is the classic cause of broken links in a coverage report.

One stable address per purpose

Don't create a report per run. Create one per thing you want to be able to link forever:

coverage on main — updated on every merge; the README badge links to it.
nightly benchmark — updated nightly; the history is the performance trend, which is the part maintainers actually want and CI artifacts never give you.

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$COVERAGE_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d @coverage.json

Because revisions land at the same URL, a link in a two-year-old issue thread still opens something meaningful.

Discussion on the line, not in the thread

A contributor's question about coverage is about one file. An anchored comment stays on that file's row, which is a much better experience for someone who has not yet learned the codebase than a 40-comment PR thread. See commenting on HTML.

Reviewers and readers need no account and are never charged, so there is no seat cost to a large community reading your reports.

Fork PRs, carefully

Publishing needs a token, and a token in a fork-triggered workflow is a credential handed to code you haven't reviewed. Most providers withhold secrets from fork runs precisely for this reason — keep that default.

The safe shape is a trusted workflow that runs after maintainer review, or publishing only from pushes to main. Use a scoped token with reports:write and nothing else, so even a leaked token cannot change who can see anything.

Worth knowing

Public is a choice. Reports start private over the API; set public deliberately for the ones meant to be linked from a README.
Private repo, public report. Visibility is per report and independent of the repository.
Limits. Entry HTML 5 MB; assets 25 MB per file, 250 MB and 500 files per report. Per-file coverage trees are the usual file-count offender; most tools have a single-page HTML mode.
Free covers this. Unlimited reports, unlimited readers, unlimited revision history.

Try it

Start free →