Review pull requests with refquiem

.github/workflows/refquiem-post.yml

@@ -0,0 +1,36 @@
+---
+name: refquiem-post
+
+"on":
+  workflow_run: # zizmor: ignore[dangerous-triggers] the job reads only the scan's payload
+    workflows: [refquiem]
+    types: [completed]
+
+permissions: {}
+
+# This job holds a write token, so it never checks out or runs pull request
+# code. The action posts only to the open pull request whose head the scan built.
+jobs:
+  post:
+    name: Post the review
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: refquiem-payload
+          path: ${{ runner.temp }}/refquiem-payload
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - uses: LucaCappelletti94/cargo-refquiem@bacf8060022d8357e428bf19f031b8347f5f9d35 # v0.2.1
+        with:
+          mode: post
+          payload: ${{ runner.temp }}/refquiem-payload

.github/workflows/refquiem.yml

@@ -0,0 +1,42 @@
+---
+name: refquiem
+
+"on":
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: refquiem-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+# Prepares the review with no write token, so fork pull requests are scanned
+# too. refquiem-post.yml posts it.
+jobs:
+  scan:
+    name: refquiem
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # One scan of the root workspace, since every refquiem review replaces the
+      # previous one on the pull request.
+      - uses: LucaCappelletti94/cargo-refquiem@bacf8060022d8357e428bf19f031b8347f5f9d35 # v0.2.1
+        id: refquiem
+        with:
+          version: 0.2.1
+          pr-number: ${{ github.event.pull_request.number }}
+          mode: prepare
+          payload: ${{ runner.temp }}/refquiem-payload
+
+      - if: steps.refquiem.outputs.review-status == 'prepared'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: refquiem-payload
+          path: ${{ runner.temp }}/refquiem-payload
+          retention-days: 7
+          if-no-files-found: error