ci: ensure PR checks UI is updated

[scotthart]

• Commit Status Publishing (report-status job):

  • Added statuses: write permission to the workflow.
  • On /gharun (issue_comment), pre-flight publishes a pending status check directly to PR_SHA.
  • Added a new report-status job that runs at the end of the workflow and updates the gha: macOS & Windows status check on PR_SHA to success or failure. This ensures the PR checks UI accurately displays the /gharun build result.

• Historical /gharun Comment Detection on PRs:

  • When pull_request_target runs for an untrusted author (e.g. on PR sync or manual retry), Verify permissions now inspects PR comments to check if a trusted maintainer previously approved the PR with /gharun.
  • If a trusted /gharun comment is found, is_trusted is set to true and the build proceeds.

• Graceful Skip for Initial Untrusted PRs:

  • When an untrusted author opens/syncs a PR without existing /gharun approval, pre-flight outputs is_trusted=false and downstream jobs are skipped cleanly instead of failing pre-flight with exit 1.

• New Commits from Untrusted Authors Always Require a Fresh /gharun Comment:

  • When an untrusted author opens or updates a PR (pushing a new commit via pull_request_target), pre-flight checks the author's permission.
  • If the author is untrusted, is_trusted is set to false and all downstream build jobs (macos-bazel, windows-cmake) are skipped.
  • pull_request_target does not scan historical comments. Previous /gharun comments posted on earlier commits are ignored.

• Real-time Approval Only via issue_comment:

  • Builds on untrusted PRs can only be triggered by an active /gharun comment event (issue_comment).
  • When a trusted maintainer posts /gharun, the workflow evaluates the commenter's permissions in real time and runs the build against the PR's current head commit.
  • If the untrusted author pushes another commit afterwards, the new commit will be skipped until a maintainer reviews the new code and posts /gharun again.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.28%. Comparing base (0b256dd) to head (5dfd848).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16439      +/-   ##
==========================================
+ Coverage   92.27%   92.28%   +0.01%     
==========================================
  Files        2246     2246              
  Lines      212774   212774              
==========================================
+ Hits       196330   196366      +36     
+ Misses      16444    16408      -36     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[colinmoy]

see Zizmor warning