[LukasAud]

Summary

• Fork PRs don't get secrets (e.g. PUPPET_FORGE_TOKEN, CODECOV_TOKEN) via the normal pull_request trigger, so CI silently skips secret-dependent steps for external contributors.
• Adds pr_number/ref inputs to the existing workflow_dispatch: trigger and a resolve-ref job that resolves either into refs/pull/<n>/merge (or the raw ref, or empty string meaning "no override").
• Threads ref: ${{ needs.resolve-ref.outputs.ref }} into the spec and acceptance jobs' with: blocks, relying on puppetlabs/cat-github-actions PR #191 (merged to main) which added an optional ref input to gem_ci.yml/gem_acceptance.yml.
• workflow_dispatch is already gated to users with repo write access, so this is the trust boundary — no extra label/approval system added.
• Both spec and acceptance were already pinned to @main for the reusable workflows, so no pin bump was needed.

Test plan

• Manually dispatch the workflow with a ref input (e.g. a branch name) and confirm it checks out that ref.
• Manually dispatch the workflow with a pr_number input (e.g. a fork PR number) and confirm it checks out refs/pull/<n>/merge and secrets are available.
• Confirm a normal push/pull_request run is unaffected (empty ref passed through, behaves exactly as before).

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (d9cd390) to head (d811654).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #120   +/-   ##
=======================================
  Coverage   94.96%   94.96%           
=======================================
  Files           2        2           
  Lines         159      159           
=======================================
  Hits          151      151           
  Misses          8        8           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.