Fix comment not being removed if preflight has no match

Author: Seldaek

README.md

@@ -10,7 +10,7 @@ For every modified PHP file the action:
 2. Snapshots the same files on the **base** ref (extracted with `git archive`).
 3. Diffs the two snapshots. A method or constant is only reported on a class when its **introduction point** is the class itself — implementations of existing interface methods, overrides of parent methods, or members already declared on a parent in the unchanged code are not flagged.
 
-The result is written to a directory containing `comment-body.txt` (a markdown body, possibly empty) and `pr-number.txt`. A companion `scripts/post-comment.sh` posts/updates/deletes a PR comment based on that artifact.
+The result is written to a directory containing `comment-body.txt` (a markdown body, possibly empty). A companion `post-comment` sub-action posts, updates, or deletes a PR comment based on that body.
 
 ## Why static reflection?
 
@@ -84,8 +84,10 @@ jobs:
               echo "should-run=true" >> "$GITHUB_OUTPUT"
           fi
 
+      # Resolve the PR unconditionally so we can clean up a stale comment
+      # even when preflight says no API-relevant changes (e.g. a PR was
+      # updated to revert previously-reported additions).
       - id: pr
-        if: steps.preflight.outputs.should-run == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -96,21 +98,20 @@ jobs:
           echo "number=$number" >> "$GITHUB_OUTPUT"
           echo "base-ref=$base_ref" >> "$GITHUB_OUTPUT"
 
-      - if: steps.pr.outputs.number
+      - if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true'
         uses: actions/checkout@v6
         with:
           ref: refs/pull/${{ steps.pr.outputs.number }}/head
           fetch-depth: 0
           persist-credentials: false
 
-      - if: steps.pr.outputs.number
+      - if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true'
         run: git fetch --no-tags origin "${{ steps.pr.outputs.base-ref }}:refs/remotes/origin/${{ steps.pr.outputs.base-ref }}"
 
-      - if: steps.pr.outputs.number
+      - if: steps.pr.outputs.number && steps.preflight.outputs.should-run == 'true'
         uses: composer/api-surface-check@main
         with:
           base-ref: origin/${{ steps.pr.outputs.base-ref }}
-          pr-number: ${{ steps.pr.outputs.number }}
           # INPUTS / CONFIG GOES HERE
           # install-dependencies: true
           # paths: src/**/*.php
@@ -119,10 +120,15 @@ jobs:
           # show-removed: true
           # show-modified: true
 
+      # Always run post-comment when we have a PR. With analysis skipped,
+      # comment-body.txt is missing/empty and post-comment deletes any
+      # previously-posted bot comment.
       - if: steps.pr.outputs.number
+        uses: composer/api-surface-check/post-comment@main
+        with:
+          pr-number: ${{ steps.pr.outputs.number }}
         env:
           GH_TOKEN: ${{ github.token }}
-        uses: composer/api-surface-check/post-comment@main
 ```
 
 ### Why two workflows
@@ -157,7 +163,6 @@ jobs:
 | Input            | Default                    | Description                                                  |
 | ---------------- | -------------------------- | ------------------------------------------------------------ |
 | `base-ref`       | _required_                 | Git ref to compare HEAD against (e.g. `origin/main`).        |
-| `pr-number`      | (empty)                    | Saved alongside the comment body for the comment workflow.  |
 | `output-dir`     | `api-surface-result`       | Directory the artifact is written to.                       |
 | `comment-marker` | `<!-- api-surface-bot -->` | HTML marker used to identify previous bot comments.         |
 
@@ -184,12 +189,13 @@ Quickly scans the PR diff for tokens that could affect the API surface. Writes `
 
 ### `composer/api-surface-check/post-comment`
 
-Posts, updates, or deletes a PR comment based on the artifact produced by the main action. Use it in the comment workflow.
+Posts, updates, or deletes a PR comment based on the artifact produced by the main action. Use it in the comment workflow. Run it unconditionally once the PR is resolved — when given an empty/missing `comment-body.txt` it deletes any previously-posted bot comment, which fixes stale comments after a PR is updated to revert API additions.
 
-| Input            | Default                              | Description                                              |
-| ---------------- | ------------------------------------ | -------------------------------------------------------- |
-| `output-dir`     | `api-surface-result`                 | Directory containing `comment-body.txt`/`pr-number.txt`. |
-| `comment-marker` | `<!-- api-surface-bot -->`           | HTML marker that identifies previous bot comments.       |
+| Input            | Default                    | Description                                                                                                |
+| ---------------- | -------------------------- | ---------------------------------------------------------------------------------------------------------- |
+| `pr-number`      | _required_                 | PR number to post / update / delete the comment on.                                                        |
+| `output-dir`     | `api-surface-result`       | Directory containing `comment-body.txt`. An empty/missing body deletes any existing marked comment.        |
+| `comment-marker` | `<!-- api-surface-bot -->` | HTML marker that identifies previous bot comments.                                                         |
 
 Requires `GH_TOKEN` env (passed in by the consumer) with `pull-requests: write`.
 

action.yml

@@ -21,10 +21,6 @@ inputs:
     description: 'Directory to write outputs to (relative to the consuming workflow''s working dir).'
     required: false
     default: 'api-surface-result'
-  pr-number:
-    description: 'Pull request number; written to the artifact for the comment workflow.'
-    required: false
-    default: ''
   include-internal:
     description: 'Include symbols marked with @internal or @private.'
     required: false
@@ -71,7 +67,7 @@ outputs:
     description: 'Whether any reportable API surface changes were detected.'
     value: ${{ steps.detect.outputs.has-changes }}
   output-dir:
-    description: 'Directory containing comment-body.txt, pr-number.txt, and snapshots.'
+    description: 'Directory containing comment-body.txt and the head/base snapshot JSON files.'
     value: ${{ steps.detect.outputs.output-dir }}
 
 runs:
@@ -120,7 +116,6 @@ runs:
         SOURCE_ROOTS: ${{ inputs.source-roots }}
         VENDOR_PATH: ${{ steps.project-deps.outputs.vendor-path }}
         OUTPUT_DIR: ${{ inputs.output-dir }}
-        PR_NUMBER: ${{ inputs.pr-number }}
         INCLUDE_INTERNAL: ${{ inputs.include-internal }}
         TYPES: ${{ inputs.types }}
         VISIBILITY: ${{ inputs.visibility }}

post-comment/action.yml

@@ -6,8 +6,11 @@ branding:
   color: 'blue'
 
 inputs:
+  pr-number:
+    description: 'PR number to post / update / delete the comment on.'
+    required: true
   output-dir:
-    description: 'Directory containing comment-body.txt and pr-number.txt produced by the analysis action.'
+    description: 'Directory containing the comment-body.txt produced by the analysis action. An empty or missing body deletes any existing marked comment (used for stale-comment cleanup when analysis is skipped).'
     required: false
     default: 'api-surface-result'
   comment-marker:
@@ -23,4 +26,5 @@ runs:
       env:
         OUTPUT_DIR: ${{ inputs.output-dir }}
         COMMENT_MARKER: ${{ inputs.comment-marker }}
+        PR_NUMBER: ${{ inputs.pr-number }}
       run: bash ${{ github.action_path }}/../scripts/post-comment.sh

scripts/detect.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Detect API surface changes between BASE_REF and HEAD.
 # Reads configuration from env vars (set by the action), produces an output
-# directory containing comment-body.txt (markdown body, possibly empty),
-# pr-number.txt (if PR_NUMBER is set), and the raw snapshots/diff for debugging.
+# directory containing comment-body.txt (markdown body, possibly empty) and
+# the head/base snapshot JSON files (kept for debugging).
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -12,7 +12,6 @@ BASE_REF="${BASE_REF:?BASE_REF is required}"
 PATHS_GLOB="${PATHS_GLOB:-src/**/*.php}"
 SOURCE_ROOTS="${SOURCE_ROOTS:-src}"
 OUTPUT_DIR="${OUTPUT_DIR:-api-surface-result}"
-PR_NUMBER="${PR_NUMBER:-}"
 
 INCLUDE_INTERNAL="${INCLUDE_INTERNAL:-false}"
 TYPES="${TYPES:-class,interface,trait,enum,method,property,constant}"
@@ -38,9 +37,6 @@ read -r -a roots_array <<< "$(echo "${SOURCE_ROOTS}" | tr '\n' ' ' | tr ',' ' ')
 
 mkdir -p "${OUTPUT_DIR}"
 : > "${OUTPUT_DIR}/comment-body.txt"
-if [[ -n "${PR_NUMBER}" ]]; then
-    echo "${PR_NUMBER}" > "${OUTPUT_DIR}/pr-number.txt"
-fi
 
 # All files in scope (added, modified, or deleted) — snapshot.php will silently
 # ignore missing files, so we can pass the same list for both refs.

scripts/post-comment.sh

@@ -8,13 +8,11 @@ OUTPUT_DIR="${OUTPUT_DIR:-api-surface-result}"
 COMMENT_MARKER="${COMMENT_MARKER:-<!-- api-surface-bot -->}"
 GITHUB_REPOSITORY="${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
 : "${GH_TOKEN:?GH_TOKEN is required}"
+: "${PR_NUMBER:?PR_NUMBER is required}"
 
-if [[ ! -f "${OUTPUT_DIR}/pr-number.txt" ]]; then
-    echo "No pr-number.txt in ${OUTPUT_DIR}; nothing to do."
-    exit 0
-fi
-
-PR_NUMBER=$(cat "${OUTPUT_DIR}/pr-number.txt")
+# An empty body (or missing comment-body.txt) means: delete any existing
+# marked comment. This is what cleans up stale comments after a PR is updated
+# to remove the API additions originally reported.
 COMMENT_BODY=""
 if [[ -s "${OUTPUT_DIR}/comment-body.txt" ]]; then
     COMMENT_BODY=$(cat "${OUTPUT_DIR}/comment-body.txt")

tests/DetectTest.php

@@ -239,18 +239,6 @@ public function testModifiedSignatureRequiresFlag(): void
         $this->assertStringContainsString('now: `public function mut(int $x, int $y): void`', $body);
     }
 
-    public function testPrNumberIsWrittenWhenProvided(): void
-    {
-        $this->commit(['src/Foo.php' => "<?php\nnamespace L;\nclass Foo {}\n"], 'base');
-        $this->commit(['src/Foo.php' => "<?php\nnamespace L;\nclass Foo { public function hi(): void {} }\n"], 'add method');
-
-        $this->runDetect(['PR_NUMBER' => '424242']);
-
-        $prFile = $this->repoDir . '/result/pr-number.txt';
-        $this->assertFileExists($prFile);
-        $this->assertSame('424242', trim(file_get_contents($prFile)));
-    }
-
     public function testVendorParentMethodIsNotReportedWhenVendorPathIsProvided(): void
     {
         // Pretend vendor/ is composer-installed: it lives outside SOURCE_ROOTS