Add a shared pull request report publisher (astral-sh#29603)

Add `publish-pull-request-report.yml` as a shared publisher for
automation reports, using STS for GitHub writes and the KV actions for
comment IDs. Store IDs in `pull-request` scope so later runs can update
the same report.

Look up each stored ID directly and verify the bot, PR, marker, and run
metadata. When a report is published, missing or expired keys create a
new comment without scanning existing comments; deleted comments are
replaced. Malformed IDs, IDs belonging to another comment, and KV errors
fail the job. The publisher verifies the source run and current PR head
before writing; report workflows enable it separately.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

Author: zanieb

.github/actionlint.yaml

@@ -25,6 +25,12 @@ paths:
     ignore:
       # actionlint doesn't yet support concurrency queues. The schema hook validates them.
       - '^unexpected key "queue" for "concurrency" section\.'
+  ".github/workflows/publish-pull-request-report.yml":
+    ignore:
+      # actionlint doesn't yet support concurrency queues. The schema hook validates them.
+      - '^unexpected key "queue" for "concurrency" section\.'
+      # actionlint doesn't yet recognize the reusable workflow's own revision context.
+      - 'property "workflow_(repository|sha)" is not defined in object type'
   ".github/workflows/{ty-ecosystem-report,ty-ecosystem-analyzer,memory_report,sync_typeshed}.yaml":
     ignore:
       # actionlint doesn't yet support the cache-mode feature.

.github/workflows/publish-pull-request-report.yml

@@ -0,0 +1,107 @@
+name: Publish a pull request report
+
+on:
+  workflow_call:
+    inputs:
+      report:
+        type: string
+        required: true
+      artifact:
+        type: string
+        required: true
+      filename:
+        type: string
+        required: true
+      title:
+        type: string
+        default: ""
+      full-report-artifact:
+        type: string
+        default: ""
+    secrets:
+      KV_API_URL:
+        required: true
+      STS_API_URL:
+        required: true
+
+permissions: {}
+
+env:
+  UV_LOCKED: 1
+
+jobs:
+  publish:
+    if: >-
+      github.repository == 'astral-sh/ruff' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: github-ubuntu-24.04-x86_64-2
+    timeout-minutes: 10
+    environment: automations
+    permissions:
+      contents: read
+      id-token: write
+    concurrency:
+      group: pull-request-report-${{ github.event.pull_request.number }}-${{ inputs.report }}
+      cancel-in-progress: false
+      queue: max
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}
+          sparse-checkout: scripts
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+        with:
+          # renovate: datasource=github-release-attachments depName=astral-sh/uv
+          version: "0.13.4"
+          checksum: "2b428396f12572d4429cf210ca234dd599a33b3af0958a4d5ed569d63e3f344f"
+          enable-cache: false
+      - name: Read the stored comment ID
+        uses: astral-sh/github-actions/key-value-store/get@9ece8e1afa7e9485a0bc35c40e34e1fa495ae454
+        with:
+          service-url: ${{ secrets.KV_API_URL }}
+          scope: pull-request
+          key: report-comment-${{ inputs.report }}
+          path: ${{ runner.temp }}/report-comment-id-${{ github.run_id }}-${{ github.run_attempt }}
+      - name: Get a report publishing token
+        id: token
+        uses: open-security-tools/ost-simple-sts@9e012247e07c39080fb6a832dbfbcfeacebc19c4
+        with:
+          exchange-url: ${{ secrets.STS_API_URL }}/exchange
+          audience: ${{ secrets.STS_API_URL }}
+          repository: astral-sh/ruff
+          permissions: |
+            actions: read
+            pull_requests: write
+      - name: Publish the report
+        id: publish
+        env:
+          GH_TOKEN: ${{ steps.token.outputs.token }}
+          RUN_ID: ${{ github.run_id }}
+          RUN_ATTEMPT: ${{ github.run_attempt }}
+          WORKFLOW_REF: ${{ github.workflow_ref }}
+          REPORT: ${{ inputs.report }}
+          REPORT_ARTIFACT: ${{ inputs.artifact }}
+          REPORT_FILENAME: ${{ inputs.filename }}
+          REPORT_TITLE: ${{ inputs.title }}
+          FULL_REPORT_ARTIFACT: ${{ inputs.full-report-artifact }}
+          PULL_REQUEST: ${{ github.event.pull_request.number }}
+          COMMENT_ID_FILE: ${{ runner.temp }}/report-comment-id-${{ github.run_id }}-${{ github.run_attempt }}
+        run: >-
+          uv run --script scripts/publish_pr_report.py
+          --run-id "$RUN_ID" --run-attempt "$RUN_ATTEMPT"
+          --workflow-ref "$WORKFLOW_REF"
+          --report "$REPORT" --pull-request "$PULL_REQUEST"
+          --artifact "$REPORT_ARTIFACT" --filename "$REPORT_FILENAME"
+          --title "$REPORT_TITLE" --full-report-artifact "$FULL_REPORT_ARTIFACT"
+          --comment-id-file "$COMMENT_ID_FILE"
+      - name: Store the comment ID
+        if: steps.publish.outputs.comment-id != ''
+        uses: astral-sh/github-actions/key-value-store/put@9ece8e1afa7e9485a0bc35c40e34e1fa495ae454
+        with:
+          service-url: ${{ secrets.KV_API_URL }}
+          scope: pull-request
+          key: report-comment-${{ inputs.report }}
+          value: ${{ steps.publish.outputs.comment-id }}