Update dotnet.yml: refine permissions and coverage logic

Author: pwelter34

.github/workflows/dotnet.yml

@@ -6,7 +6,6 @@ env:
   DOTNET_ENVIRONMENT: github
   ASPNETCORE_ENVIRONMENT: github
   BUILD_PATH: "${{github.workspace}}/artifacts"
-  COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
 
 on:
   push:
@@ -20,6 +19,9 @@ on:
       - master
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   build:
 
@@ -46,9 +48,11 @@ jobs:
         run: dotnet test --no-build --configuration Release --collect:"XPlat Code Coverage" --settings coverlet.runsettings
 
       - name: Report Coverage
-        if: success()
+        if: success() && github.event_name != 'pull_request'
         continue-on-error: true
         uses: coverallsapp/github-action@v2
+        env:
+          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}
         with:
           file: "${{github.workspace}}/test/*/TestResults/*/coverage.info"
           format: lcov
@@ -80,6 +84,10 @@ jobs:
     needs: build
     if: success() && github.event_name != 'pull_request' && (github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/v'))
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Download Artifact
         uses: actions/download-artifact@v8