ci: update snyk, submodule check, codecov (#111)

Author: aaron-steinfeld

.github/workflows/pr-build.yml

@@ -20,6 +20,9 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: Ensure submodules point to commit from main branch
+        run: git submodule foreach --recursive "git merge-base --is-ancestor HEAD origin/main"
+
       - name: create checksum file
         uses: hypertrace/github-actions/checksum@main
 
@@ -72,7 +75,7 @@ jobs:
       - name: Setup snyk
         uses: snyk/actions/[email protected]
       - name: Snyk test
-        run: snyk test --all-sub-projects --org=hypertrace --severity-threshold=low --policy-path=.snyk
+        run: snyk test --all-sub-projects --org=hypertrace --severity-threshold=low --policy-path=.snyk --remote-repo-url='${{ github.server_url }}/${{ github.repository }}.git'
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
           GRADLE_OPTS: -Dorg.gradle.workers.max=1 # Snyk doesn't handle parallelism

.github/workflows/pr-test.yml

@@ -35,10 +35,9 @@ jobs:
           args: jacocoTestReport
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v1
+        uses: codecov/codecov-action@v2
         with:
           name: unit test reports
-          fail_ci_if_error: true
           flags: unit
 
       - name: copy test reports