`pull_request_target` trigger is treated as `push` rather than a pull request

Coveralls GitHub Action requires a secret token, that is only available for pull requests in two cases:

1. Pull request was open from the same repository
2. GitHub Action workflow was triggered by pull_request_target event.

The latter, however, appears to be completely ignored by this action. I do not receive a PR comment, and the UI is showing that the target commit is my main branch HEAD.

Apparently, Coveralls uses $GITHUB_SHA to identify the commit. Which in case of pull_request_target equals to the main commit, not the PR commit. I tried fixing that with the following snippet:

    - id: sha
      run: echo "SHA=$(git rev-parse HEAD)" > $GITHUB_OUTPUT
    - name: Coveralls
      uses: coverallsapp/github-action@v2
      with:
        git-commit: ${{ steps.sha.outputs.SHA }}

but the commit hash on the Coveralls UI remains the same, and the comparison fails.

Here's an example of a PR: https://github.com/perf-toolbox/tir/pull/29
And whatever was generated for that event: https://coveralls.io/builds/67039590
Even though I delete a bunch of tests, the Coveralls shows that the PR introduced no changes. Only after I commit that PR, I can see my updated coverage info.

Start with the coverallsapp/github-action@v2 entry point and trace how GITHUB_SHA and the git-commit input are handled for pull_request_target events. Reproduce the workflow using the supplied PR and compare the reported commit and coverage with a normal pull request. Done means the target event reports the PR commit and its coverage comparison includes the changed files.