fix(ci): 修复 PR 性能报告评论权限 (#1147)

* fix(ci): 修复性能报告评论权限

* fix(ci): 放宽自动创建 release pr 的证书门禁

Author: sonofmagic

.github/workflows/benchmark-pr-report.yml

@@ -12,8 +12,7 @@ concurrency:
 permissions:
   actions: read
   contents: read
-  issues: write
-  pull-requests: read
+  pull-requests: write
 
 jobs:
   publish:

.github/workflows/release.yml

@@ -80,6 +80,7 @@ jobs:
           pnpm exec playwright install chromium chromium-headless-shell
 
       - name: Download same-commit coverage certificate
+        if: inputs.mode == 'publish' || inputs.mode == 'publish-unpublished'
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_CERTIFICATE_RUN_ID: ${{ vars.RELEASE_CERTIFICATE_RUN_ID }}
@@ -112,6 +113,7 @@ jobs:
           gh run download "$run_id" --name "$certificate_name" --dir e2e/.artifacts/release-certificate
 
       - name: Validate release certificate
+        if: inputs.mode == 'publish' || inputs.mode == 'publish-unpublished'
         shell: bash
         run: |
           report="$(find e2e/.artifacts/release-certificate -type f \( -name 'nightly-report.json' -o -name 'pr-report.json' -o -name 'coverage-report.json' \) -print -quit)"

e2e/RELEASE-CERTIFICATION.md

@@ -23,13 +23,13 @@ pnpm e2e:local:full-report --profile full
 
 ## Release gate
 
-release workflow 只下载与 `$GITHUB_SHA` 相同的 `coverage-certificate-$GITHUB_SHA` artifact，然后执行：
+只有显式执行 `publish` 或 `publish-unpublished` 时，release workflow 才下载与 `$GITHUB_SHA` 相同的 `coverage-certificate-$GITHUB_SHA` artifact，然后执行：
 
 ```bash
 pnpm e2e:coverage:release-gate --report <coverage-report.json>
 ```
 
-validator 会重新计算 summary，检查 registry/catalog/toolchain identity、required layer、artifact checksum 和 cosign 签名元数据。没有同 SHA 的认证 artifact、没有 local-required 证据或签名校验失败时，`repo release ci` 不会执行。
+validator 会重新计算 summary，检查 registry/catalog/toolchain identity、required layer、artifact checksum 和 cosign 签名元数据。显式发布模式没有同 SHA 的认证 artifact、没有 local-required 证据或签名校验失败时，`repo release ci` 不会执行。默认 `auto` 和 `prepare` 模式跳过该门禁，可正常创建 release PR。
 
 认证 artifact 必须来自仓库变量 `RELEASE_CERTIFICATE_RUN_ID` 指定的已完成成功 workflow run。Release 不会自动选择 nightly run：hosted nightly 当前只上传诊断 artifact，且在发布启动时可能仍处于运行状态，自动选择会造成竞态并可能把诊断报告误当认证证书。生成本地/自托管认证报告后，应将上传该 artifact 的 workflow run ID 写入 `RELEASE_CERTIFICATE_RUN_ID`，并确保其 head SHA 等于发布 commit。
 

packages/weapp-tailwindcss/test/ci/workflows.test.ts

@@ -594,9 +594,14 @@ describe('ci workflows', () => {
     expect(source).not.toContain('NODE_AUTH_TOKEN:')
   })
 
-  it('requires an explicit same-commit release certificate run', () => {
-    const { source } = readWorkflow('release.yml')
+  it('requires a certificate only for explicit release publishing', () => {
+    const { source, workflow } = readWorkflow('release.yml')
+    const releaseSteps: Array<Record<string, any>> = workflow.jobs.release.steps
+    const downloadStep = releaseSteps.find(step => step.name === 'Download same-commit coverage certificate')
+    const validateStep = releaseSteps.find(step => step.name === 'Validate release certificate')
 
+    expect(downloadStep.if).toBe("inputs.mode == 'publish' || inputs.mode == 'publish-unpublished'")
+    expect(validateStep.if).toBe("inputs.mode == 'publish' || inputs.mode == 'publish-unpublished'")
     expect(source).toContain('RELEASE_CERTIFICATE_RUN_ID: ${{ vars.RELEASE_CERTIFICATE_RUN_ID }}')
     expect(source).toContain('Release certificate is not configured')
     expect(source).toContain('gh run view "$run_id" --json headSha,status,conclusion')
@@ -653,6 +658,26 @@ describe('ci workflows', () => {
     })).toBe(true)
   })
 
+  it('grants the PR benchmark reporter permission to publish pull request comments', () => {
+    const { source, workflow } = readWorkflow('benchmark-pr-report.yml')
+    const commentStep = workflow.jobs.publish.steps.find((step: Record<string, unknown>) => {
+      return step.name === 'Update PR comment'
+    })
+
+    expect(workflow.permissions).toMatchObject({
+      actions: 'read',
+      contents: 'read',
+      'pull-requests': 'write',
+    })
+    expect(workflow.permissions.issues).toBeUndefined()
+    expect(commentStep).toMatchObject({
+      uses: 'actions/github-script@v7',
+    })
+    expect(String(commentStep.if)).toContain("steps.report.outcome == 'success'")
+    expect(commentStep['continue-on-error']).not.toBe(true)
+    expect(source).toContain('github.rest.issues.createComment')
+  })
+
   it('delegates the complete package lifecycle to repoctl', () => {
     const { source, workflow } = readWorkflow('release.yml')
     const { workflow: releaseGateWorkflow } = readWorkflow('release-gate.yml')