fix(ci): stop the endpoint audit failing every fork pull request

[georgeglarson]

• A human has tested these changes.

HUMAN: Ran the endpoint audit and the tooling tests on this branch, both green. Drove the real .audit/endpoint-audit.json through a fork pull_request context against both versions of the script: the one on main throws Resource not accessible by integration and reds the job, this branch writes the job summary, logs the skip and completes.

---

Why

A pull_request raised from a fork runs with a read-only GITHUB_TOKEN, so the workflow's pull-requests: write grant cannot be honoured and the report's comment POST comes back 403 Resource not accessible by integration. The step is if: always(), so that 403 fails the whole endpoint-audit check on every fork pull request, whatever the audit itself found.

Two are sitting on it now. #320 is approved and 27 days old. On #362 the audit ran clean, 0 actionable client-only calls, and the job still went red on the comment step.

Push events have no PR to comment on at all, so context.issue.number is undefined there and the same guard covers them.

Summary

• Write the rendered report to the job summary on every run, so it reaches a reviewer when the comment is unavailable.
• Attempt the comment only when the run's token can write one, which is a same-repo pull_request.
• Drop the step's pull_request-only condition so push runs publish the summary too.

No permission change and no move to pull_request_target. The 403 is not swallowed: a same-repo run that cannot comment still fails loudly.

Issue Number

No issue filed. Reproducible on any fork PR, most recently on #362: https://github.com/OpenHands/typescript-client/actions/runs/33214568712/job/98995208868

How to Test

npm ci
npm run audit:endpoints            # writes the real .audit/endpoint-audit.json
npm run test:endpoint-audit-tooling

The tooling tests cover four cases: a same-repo PR comments and writes the summary, a fork writes the summary and never calls the comment API, a push behaves like the fork case, and a missing report still warns with nothing published.

To see the failure and the fix against the report this repo actually produces, drive postEndpointAuditReport with a fork pull_request context (head repo different from the base) and a createComment that throws a 403. The version on main throws out of the step and reds the job. This branch writes the summary, logs the skip, and completes.

Video/Screenshots

Type

• Bug fix
• Feature
• Refactor
• Breaking change
• Docs / chore

Notes

canCommentOnPullRequest is exported alongside the existing helpers so the guard can be exercised directly.

[all-hands-bot]

🤖 OpenHands is reviewing this PR.

Head commit: f6309444c3692ef031ac591e5801e6dd407c31da
View the conversation: https://oss-agent-canvas.ngrok.dev/conversations/67ead331-4a7b-437a-b02c-e0e7eddee580

This comment was posted by an AI agent (OpenHands).