# Coverage, Benchmarks and Build Reports Contributors Can Actually Open

Canonical: https://commareports.com/for/open-source-maintainers
Published: 2026-09-11

> A contributor's CI run produced a coverage report locked behind an artifact download they may not have permission for. Publish it to a public URL and link it from the PR.

# Reports contributors can open

Open source runs on drive-by contributors, and drive-by contributors hit a
wall that maintainers stopped noticing years ago: **the CI artifact is not
readable by them**. It's a zip behind the provider's auth, the download may
require permissions a first-time contributor doesn't have, and when they do
get it, the HTML often opens blank because it was separated from its assets.

So they ask in the PR thread what the coverage change was, and you paste a
number from your own screen. That's the loop worth deleting.

## Publish it, link it from the PR

One step in the workflow turns the report into a URL anyone can open — no
account, no download, no login wall:

- [GitHub Actions](/ci/github-actions-html-report) ·
  [GitLab CI](/ci/gitlab-ci-html-report) ·
  [CircleCI](/ci/circleci-html-report) ·
  [Travis CI](/ci/travis-ci-html-report) — and the rest at [/ci](/ci).

The reports that matter most to contributors:

- [Coverage](/share-coverage-report) · [lcov](/share-lcov-report) ·
  [Istanbul](/share-istanbul-report) · [JaCoCo](/share-jacoco-report) ·
  [Cobertura](/share-cobertura-report) · [SimpleCov](/share-simplecov-report) ·
  [Rust coverage](/share-rust-coverage-report)
- [Benchmarks](/share-benchmark-report) ·
  [Criterion](/share-criterion-benchmark-report) ·
  [JMH](/share-jmh-benchmark-report)
- [Bundle size](/share-bundle-analyzer-report) ·
  [source-map-explorer](/share-source-map-explorer-report) ·
  [rollup-visualizer](/share-rollup-visualizer-report)
- Lint and quality: [ESLint](/share-eslint-report) ·
  [Ruff](/share-ruff-report) · [Clippy-adjacent Rust output](/share-rustdoc) ·
  [SonarQube](/share-sonarqube-report)
- Docs builds: see [for technical writers](/for/technical-writers)

Publish the [whole output folder](/share-html-folder). A coverage report is
one entry page plus a file tree; sending only `index.html` is the classic
cause of [broken links in a coverage report](/fix/coverage-report-links-broken).

## One stable address per purpose

Don't create a report per run. Create one per **thing you want to be able to
link forever**:

- `coverage on main` — updated on every merge; the README badge links to it.
- `nightly benchmark` — updated nightly; the history is the performance trend,
  which is the part maintainers actually want and CI artifacts never give you.

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$COVERAGE_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d @coverage.json
```

Because revisions land at the same URL, a link in a two-year-old issue thread
still opens something meaningful.

## Discussion on the line, not in the thread

A contributor's question about coverage is about **one file**. An anchored
comment stays on that file's row, which is a much better experience for
someone who has not yet learned the codebase than a 40-comment PR thread. See
[commenting on HTML](/comment-on-html).

Reviewers and readers need no account and are never charged, so there is no
seat cost to a large community reading your reports.

## Fork PRs, carefully

Publishing needs a token, and a token in a fork-triggered workflow is a
credential handed to code you haven't reviewed. Most providers withhold
secrets from fork runs precisely for this reason — keep that default.

The safe shape is a trusted workflow that runs **after** maintainer review, or
publishing only from pushes to main. Use a [scoped token](/docs/api-tokens)
with `reports:write` and nothing else, so even a leaked token cannot change
who can see anything.

## Worth knowing

- **Public is a choice.** Reports start private over the API; set public
  deliberately for the ones meant to be linked from a README.
- **Private repo, public report.** Visibility is per report and independent of
  the repository.
- **Limits.** Entry HTML 5 MB; assets 25 MB per file, 250 MB and 500 files per
  report. Per-file coverage trees are the usual file-count offender; most
  tools have a single-page HTML mode.
- **Free covers this.** Unlimited reports, unlimited readers, unlimited
  revision history.

## Try it

**[Start free →](/login)**

### Related

- [For QA engineers](/for/qa-engineers) ·
  [For technical writers](/for/technical-writers)
- [GitHub Pages alternatives](/alternatives/github-pages-alternatives) ·
  [GitHub Gist HTML alternatives](/alternatives/github-gist-html-alternatives)
- [Publish reports from CI](/ci) · [Troubleshooting](/fix)