When a pull request is opened from a public fork, the action is trying to run "git push origin refs/notes/gocoverage" which fails because GH_TOKEN cannot have write access when run from a fork on a public repo. But even still, I'm not sure it should be running anyway? From your README you state:

On merge to main, the action runs go test, generates coverage data and attaches it to a git note associated with the latest's commits' SHA.

So in the (unmerged) PR we don't need to attach a new "git note", we only need to generate the delta and report on it based on a previous "git" note" off of the base branch.