ci: fix slash command feedback

.github/workflows/test-slash-command.yml

@@ -19,6 +19,12 @@ on:
 
 permissions:
   contents: read
+  # Required so slash-command-dispatch can add the 👀/🚀 reactions to the
+  # comment (the reaction uses GITHUB_TOKEN by default; a PR comment is an
+  # issue comment, so this needs issues: write). Without it the reaction POST
+  # is rejected and the commenter gets no feedback that /test was accepted.
+  issues: write
+  pull-requests: write
 
 jobs:
   slash-command-dispatch:

.github/workflows/test.yml

@@ -23,6 +23,29 @@ permissions:
   contents: read
 
 jobs:
+  # A repository_dispatch run (triggered by a /test comment) is not linked to
+  # the PR, so nothing shows up in the PR's checks. Post a "pending" commit
+  # status against the fork PR's head SHA so the run is visible on the PR while
+  # it executes. The final result is reported by the tests-pass job below.
+  report-pending:
+    name: Report tests running
+    if: github.event_name == 'repository_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      statuses: write
+    steps:
+      - name: Report pending status to PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            --method POST \
+            "repos/${{ github.repository }}/statuses/${{ github.event.client_payload.pull_request.head.sha }}" \
+            -f state=pending \
+            -f context="Tests Pass" \
+            -f description="Tests triggered via /test are running" \
+            -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
   build:
     name: Build
     # Skip fork PRs on the pull_request event — they have no secret access.
@@ -140,10 +163,23 @@ jobs:
   tests-pass:
     name: Tests Pass
     needs: [build, test]
-    if: always()
+    # Run for every trigger EXCEPT fork PRs on the pull_request event: those skip
+    # build/test (no secret access), so this gate would otherwise report a red
+    # "Tests Pass" and permanently block the PR. Leaving it unreported keeps the
+    # required check pending until a maintainer comments /test, at which point the
+    # repository_dispatch run below reports the result onto the PR head commit.
+    if: >-
+      always() &&
+      (github.event_name != 'pull_request' ||
+       github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
+    permissions:
+      # Required to report the gate result back to the fork PR's head commit
+      # for /test (repository_dispatch) runs.
+      statuses: write
     steps:
       - name: Check all matrix jobs passed
+        id: gate
         run: |
           if [ "${{ needs.build.result }}" != "success" ]; then
             echo "Build job failed: ${{ needs.build.result }}"
@@ -153,3 +189,20 @@ jobs:
             echo "One or more matrix jobs failed: ${{ needs.test.result }}"
             exit 1
           fi
+
+      - name: Report result to PR
+        # For /test runs, publish the gate outcome as a "Tests Pass" commit
+        # status on the PR head SHA so it shows on the PR and satisfies the
+        # required branch-protection check (repository_dispatch runs are not
+        # otherwise linked to the PR).
+        if: ${{ always() && github.event_name == 'repository_dispatch' }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            --method POST \
+            "repos/${{ github.repository }}/statuses/${{ github.event.client_payload.pull_request.head.sha }}" \
+            -f state="${{ steps.gate.outcome == 'success' && 'success' || 'failure' }}" \
+            -f context="Tests Pass" \
+            -f description="Tests triggered via /test" \
+            -f target_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"