Summary

The integrated-benchmark report comment never landed on fork PRs (e.g. #391, where the benchmark ran successfully five times but no comment was posted). This PR switches to the standard two-stage pull_request + workflow_run pattern so the comment can post regardless of whether the PR is from a fork.

Why the old pattern silently dropped fork-PR comments

integrated-benchmark.yml ran on pull_request. When that event fires from a fork, GitHub gives the workflow a read-only GITHUB_TOKEN — peter-evans/create-or-update-comment would 403 trying to write back. The workflow guarded the write with:

if: github.event.pull_request.head.repo.full_name == github.repository

so it skipped silently for fork PRs instead of failing. Same-repo PRs continued to get comments.

See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for the security context.

What changes

Stage 1 — integrated-benchmark.yml (modified)

• Drops issues: write / pull-requests: write permissions; the workflow no longer writes back.
• Replaces the Find Comment + Create or update comment steps with an artifact upload (actions/upload-artifact@v7) carrying SUMMARY.md, the PR number, and runner.os.
• The artifact is named integrated-benchmark-report-${{ matrix.os }} so adding more OSes to the matrix later doesn't collide.

Stage 2 — integrated-benchmark-comment.yml (new)

• Triggered on workflow_run of Integrated-Benchmark, type completed. Runs in the base repository's privilege context, where it can post comments to fork PRs.
• Permissions: contents: read, actions: read, issues: write, pull-requests: write.
• Conditional: only runs when the upstream workflow's event was pull_request and conclusion was success — preserves the same gating the original workflow had implicitly via step ordering.
• Downloads the artifact via actions/download-artifact@v8 with run-id + github-token (the documented cross-workflow recipe).
• Sanitises both pr-number.txt and runner-os.txt before substituting them into action inputs, since the artifact comes from a fork-controlled run and is therefore untrusted input.
• Runs the same peter-evans/find-comment@v4 + peter-evans/create-or-update-comment@v5 sequence the original workflow used.

Test plan

• actionlint clean on both workflow files (only the pre-existing actions/rustup metadata warning remains, unrelated to this change).
• Triggered automatically once this PR's benchmark run completes — first sign of life will be a comment posted by the new workflow on this PR. (Same-repo PR, so the old pattern would have posted too, but the new pattern is what runs.)
• Verify on a future fork PR that the comment now lands. The next agent-authored PR from Saturate/pacquet (or any fork) will exercise the path that motivated this change.

Security notes

The workflow_run workflow runs against the base ref's checkout-equivalent context, so the permission escalation is intentional and bounded. Two safeguards keep it tight:

1. The workflow doesn't check out repository code at all — no actions/checkout step. It can't be tricked into running fork-supplied scripts.
2. The two values consumed from the (untrusted) artifact — PR number and runner OS — are validated with regex / allowlist before being interpolated into action inputs.

The downloaded SUMMARY.md is treated as opaque markdown by peter-evans/create-or-update-comment, which posts via the issues-comments API. Markdown is escaped in the API call; there's no shell evaluation path through which it could elevate.

Written by an agent (Claude Code, claude-opus-4-7).

Summary by CodeRabbit

• New Features
  • Automatically post or update a benchmark summary comment on pull requests after benchmark runs complete.
• Chores
  • Improved workflow security by restricting permissions for benchmark jobs.
  • Separated benchmark report generation and upload so the comment workflow consumes the report artifact.