fix(ci): grant pull-requests write to comment-gateway feedback jobs (#2720)

Author: guapisolo

.github/workflows/comment-ci-command.yml

@@ -83,8 +83,6 @@ jobs:
   # Actions-capability commands: /rerun-failed-ci and /rerun-test <test-file>.
   actions-command:
     needs: handle-command
-    outputs:
-      workflow_run_url: ${{ steps.run-command.outputs.workflow_run_url }}
     if: needs.handle-command.outputs.capability == 'actions'
     concurrency:
       group: comment-ci-actions-${{ github.event.issue.number }}
@@ -108,7 +106,6 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Authorize and run the actions command
-        id: run-command
         env:
           CI_COMMAND_API_TOKEN: ${{ github.token }}
           CI_COMMAND_POLICY_PATH: .github/workflows/policies/comment-command-access.json
@@ -119,9 +116,13 @@ jobs:
     if: >-
       needs.actions-command.result == 'success' &&
       needs.handle-command.outputs.success_reaction == '+1'
+    # The reaction lands on a pull-request comment, and GitHub gates
+    # issues-API calls whose target issue is a PR on pull-requests scope,
+    # so issues: write alone returns 403.
     permissions:
       contents: read
       issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
@@ -138,29 +139,3 @@ jobs:
           CI_COMMAND_API_TOKEN: ${{ github.token }}
           CI_COMMAND_ACKNOWLEDGE: "true"
         run: python3 .github/workflows/scripts/comment_ci_command.py
-
-  reply-command:
-    needs: actions-command
-    if: >-
-      needs.actions-command.result == 'success' &&
-      needs.actions-command.outputs.workflow_run_url != ''
-    permissions:
-      contents: read
-      issues: write
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Check out the trusted handler
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        with:
-          ref: ${{ github.sha }}
-          persist-credentials: false
-          sparse-checkout: .github/workflows/scripts/comment_ci_command.py
-          sparse-checkout-cone-mode: false
-
-      - name: Reply with the workflow run
-        env:
-          CI_COMMAND_API_TOKEN: ${{ github.token }}
-          CI_COMMAND_REPLY: "true"
-          CI_COMMAND_WORKFLOW_RUN_URL: ${{ needs.actions-command.outputs.workflow_run_url }}
-        run: python3 .github/workflows/scripts/comment_ci_command.py

.github/workflows/run-ci-file.yml

@@ -47,7 +47,38 @@ concurrency:
   queue: max
 
 jobs:
+  # The run owns its own status comment: it is the only party that knows when
+  # execution starts, how long it takes, and how it ends. Announcing here
+  # (rather than from the gateway's reply) also covers direct dispatches.
+  announce-file-run:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      comment_id: ${{ steps.announce.outputs.comment_id }}
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Check out the trusted reporter
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/workflows/scripts/comment_ci_command.py
+          sparse-checkout-cone-mode: false
+
+      - name: Announce the file run on its pull request
+        id: announce
+        env:
+          CI_COMMAND_API_TOKEN: ${{ github.token }}
+          CI_COMMAND_FILE_RUN_STATUS: announce
+          FILE_RUN_PULL_NUMBER: ${{ inputs.pull_number }}
+          FILE_RUN_TEST_FILE: ${{ inputs.test_file }}
+          FILE_RUN_RUN_ID: ${{ github.run_id }}
+        run: python3 .github/workflows/scripts/comment_ci_command.py
+
   resolve-file-run:
+    needs: announce-file-run
     runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
@@ -134,3 +165,37 @@ jobs:
         pytest '${{ inputs.test_file }}' -v -x
     secrets:
       HF_TOKEN: ${{ needs.resolve-file-run.outputs.head_is_fork != 'true' && secrets.HF_TOKEN || '' }}
+
+  # No `if` beyond always(): a resolver failure, a cancelled run, and a failing
+  # test must all reach the pull request, or a silent run reads as a pass.
+  report-file-run:
+    needs: [announce-file-run, resolve-file-run, run-cuda-file, run-cpu-file]
+    if: always()
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Check out the trusted reporter
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/workflows/scripts/comment_ci_command.py
+          sparse-checkout-cone-mode: false
+
+      - name: Report the file run's result on its pull request
+        env:
+          CI_COMMAND_API_TOKEN: ${{ github.token }}
+          CI_COMMAND_FILE_RUN_STATUS: report
+          FILE_RUN_COMMENT_ID: ${{ needs.announce-file-run.outputs.comment_id }}
+          FILE_RUN_PULL_NUMBER: ${{ inputs.pull_number }}
+          FILE_RUN_TEST_FILE: ${{ inputs.test_file }}
+          FILE_RUN_RUN_ID: ${{ github.run_id }}
+          FILE_RUN_SUITE: ${{ needs.resolve-file-run.outputs.suite }}
+          FILE_RUN_RESOLVE_RESULT: ${{ needs.resolve-file-run.result }}
+          FILE_RUN_CUDA_RESULT: ${{ needs.run-cuda-file.result }}
+          FILE_RUN_CPU_RESULT: ${{ needs.run-cpu-file.result }}
+        run: python3 .github/workflows/scripts/comment_ci_command.py