From aec275533f5d43d717dc41391b362ab6c33afb0d Mon Sep 17 00:00:00 2001
From: reubenmiller <reuben.d.miller@gmail.com>
Date: Mon, 6 Jul 2026 13:39:36 +0200
Subject: [PATCH] ci: report /test slash command status back to the PR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Three fixes so maintainers get feedback when triggering fork-PR tests
via a /test comment and so the PR check reflects those runs:

- test-slash-command.yml: grant issues/pull-requests write so
  slash-command-dispatch can add the 👀/🚀 reactions (the reaction uses
  GITHUB_TOKEN, which previously had only contents:read and was 403'd).
- test.yml: post a pending "Tests Pass" commit status to the PR head SHA
  when a /test (repository_dispatch) run starts, so it shows on the PR.
- test.yml: skip the tests-pass gate for fork PRs on the pull_request
  event (build/test are skipped there) so it no longer reports a red
  required check, and publish the gate result as a "Tests Pass" status on
  the PR head SHA for /test runs so branch protection is satisfied.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/test-slash-command.yml |  6 +++
 .github/workflows/test.yml               | 55 +++++++++++++++++++++++-
 2 files changed, 60 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-slash-command.yml b/.github/workflows/test-slash-command.yml
index fdaf222..6e944e5 100644
--- a/.github/workflows/test-slash-command.yml
+++ b/.github/workflows/test-slash-command.yml
@@ -19,6 +19,12 @@ on:
 
 permissions:
   contents: read
+  # Required so slash-command-dispatch can add the 👀/🚀 reactions to the
+  # comment (the reaction uses GITHUB_TOKEN by default; a PR comment is an
+  # issue comment, so this needs issues: write). Without it the reaction POST
+  # is rejected and the commenter gets no feedback that /test was accepted.
+  issues: write
+  pull-requests: write
 
 jobs:
   slash-command-dispatch:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5367ca2..a0059fb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -23,6 +23,29 @@ permissions:
   contents: read
 
 jobs:
+  # A repository_dispatch run (triggered by a /test comment) is not linked to
+  # the PR, so nothing shows up in the PR's checks. Post a "pending" commit
+  # status against the fork PR's head SHA so the run is visible on the PR while
+  # it executes. The final result is reported by the tests-pass job below.
+  report-pending:
+    name: Report tests running
+    if: github.event_name == 'repository_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Report pending status to PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            --method POST \
+            "repos/${{ github.repository }}/statuses/${{ github.event.client_payload.pull_request.head.sha }}" \
+            -f state=pending \
+            -f context="Tests Pass" \
+            -f description="Tests triggered via /test are running" \
+            -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
   build:
     name: Build
     # Skip fork PRs on the pull_request event — they have no secret access.
@@ -140,10 +163,23 @@ jobs:
   tests-pass:
     name: Tests Pass
     needs: [build, test]
-    if: always()
+    # Run for every trigger EXCEPT fork PRs on the pull_request event: those skip
+    # build/test (no secret access), so this gate would otherwise report a red
+    # "Tests Pass" and permanently block the PR. Leaving it unreported keeps the
+    # required check pending until a maintainer comments /test, at which point the
+    # repository_dispatch run below reports the result onto the PR head commit.
+    if: >-
+      always() &&
+      (github.event_name != 'pull_request' ||
+       github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
+    permissions:
+      # Required to report the gate result back to the fork PR's head commit
+      # for /test (repository_dispatch) runs.
+      statuses: write
     steps:
       - name: Check all matrix jobs passed
+        id: gate
         run: |
           if [ "${{ needs.build.result }}" != "success" ]; then
             echo "Build job failed: ${{ needs.build.result }}"
@@ -153,3 +189,20 @@ jobs:
             echo "One or more matrix jobs failed: ${{ needs.test.result }}"
             exit 1
           fi
+
+      - name: Report result to PR
+        # For /test runs, publish the gate outcome as a "Tests Pass" commit
+        # status on the PR head SHA so it shows on the PR and satisfies the
+        # required branch-protection check (repository_dispatch runs are not
+        # otherwise linked to the PR).
+        if: ${{ always() && github.event_name == 'repository_dispatch' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            --method POST \
+            "repos/${{ github.repository }}/statuses/${{ github.event.client_payload.pull_request.head.sha }}" \
+            -f state="${{ steps.gate.outcome == 'success' && 'success' || 'failure' }}" \
+            -f context="Tests Pass" \
+            -f description="Tests triggered via /test" \
+            -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"