ci: overwrite runner event file so reviewdog detects fork PRs

clang-tidy-bazel-post posted no review comments on fork PRs: reviewdog
exited with "this is not PullRequest build" on every run (PRs #10550,
#10553, #10226, #10565).

Root cause, confirmed via a debug-gated env dump (public run 26681282929
attempt 2 on PR #10565): GITHUB_EVENT_PATH and GITHUB_EVENT_NAME are
runner-protected default env vars. The step-level `env:` override we used
to point reviewdog at a synthesized pull_request payload is silently
dropped -- the runner re-injects the real workflow_run event file, whose
payload carries no usable pull_request (its pull_requests[] is empty for
fork PRs). reviewdog's cienv parses that file, sees PullRequest == 0, and
bails before posting. The synthesized side file was correct but never read.

Fix: stop trying to override the env pointer (a no-op) and instead
overwrite the runner's event file in place with the synthesized
pull_request payload. reviewdog's cienv only parses the file at
GITHUB_EVENT_PATH (it does not check GITHUB_EVENT_NAME), so the overwrite
alone makes detection succeed. Owner/repo/head-sha all come from the
payload we write, so the now-dead GITHUB_* overrides on the reviewdog step
are removed. Nothing after the synth step depends on the original
workflow_run event, so overwriting it is safe.

The debug-gated diagnostic step (runner.debug == '1') is kept and updated
to verify the event file now holds the synthesized payload.

Signed-off-by: Joao Luis Sombrio <sombrio@sombrasoft.dev>

Author: sombraSoft

.github/workflows/github-actions-clang-tidy-bazel-post.yml

@@ -81,20 +81,20 @@ jobs:
           done < pr-meta.txt
 
       - name: Synthesize pull_request event payload
-        id: event
         env:
           PR_NUMBER: ${{ steps.meta.outputs.pr_number }}
           HEAD_SHA: ${{ steps.meta.outputs.head_sha }}
           BASE_SHA: ${{ steps.meta.outputs.base_sha }}
           HEAD_REPO: ${{ steps.meta.outputs.head_repo }}
           BASE_REPO: ${{ steps.meta.outputs.base_repo }}
         run: |
-          # Reviewdog's `github-pr-review` reporter reads GITHUB_EVENT_PATH
-          # expecting a pull_request payload. The real event here is
-          # workflow_run, so we synthesize the minimum payload reviewdog
-          # needs and point GITHUB_EVENT_PATH at it for the next step.
-          EVENT_PATH="${RUNNER_TEMP}/pr-event.json"
-          python3 - <<'PY' > "$EVENT_PATH"
+          # reviewdog reads pull_request.number from the event file at
+          # GITHUB_EVENT_PATH; the workflow_run event has none (its
+          # pull_requests[] is empty for fork PRs), so it bails with "this is
+          # not PullRequest build". GITHUB_EVENT_PATH is runner-protected, so
+          # an env: override is silently ignored — overwrite the event file in
+          # place instead. Safe: nothing downstream reads the original event.
+          python3 - <<'PY' > "${GITHUB_EVENT_PATH}"
           import json, os
           payload = {
             "action": "synchronize",
@@ -118,57 +118,34 @@ jobs:
           }
           print(json.dumps(payload))
           PY
-          echo "event_path=${EVENT_PATH}" >> "$GITHUB_OUTPUT"
 
       - name: Set up reviewdog
         uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f  # v1.5.0
         with:
           reviewdog_version: latest
 
       - name: Dump reviewdog-visible env and event payload
-        # Gated on debug re-runs. Reviewdog emits "this is not PullRequest
-        # build" and posts nothing for fork PRs even though the synthesized
-        # pull_request payload is well-formed (verified locally against
-        # reviewdog v0.21.0). Suspect: step-level `env:` cannot override
-        # runner-protected GITHUB_EVENT_PATH / GITHUB_EVENT_NAME, so reviewdog
-        # reads the runner's workflow_run event payload instead of our synth.
-        # This step proves what reviewdog actually sees on the next debug
-        # re-run.
+        # Debug-gated: confirm the event file now holds the synthesized
+        # pull_request payload reviewdog will read.
         if: runner.debug == '1'
-        env:
-          GITHUB_EVENT_NAME: pull_request
-          GITHUB_EVENT_PATH: ${{ steps.event.outputs.event_path }}
-          GITHUB_SHA: ${{ steps.meta.outputs.head_sha }}
-          GITHUB_REPOSITORY: ${{ steps.meta.outputs.base_repo }}
         run: |
-          echo "::group::GITHUB_* env visible to next step"
+          echo "::group::GITHUB_* env visible to reviewdog"
           env | grep -E '^(GITHUB_|RUNNER_|REVIEWDOG_)' | sort
           echo "::endgroup::"
-          echo "::group::Synth event file location and content"
-          echo "steps.event.outputs.event_path = ${{ steps.event.outputs.event_path }}"
-          echo "Effective GITHUB_EVENT_PATH    = ${GITHUB_EVENT_PATH}"
+          echo "::group::Effective GITHUB_EVENT_PATH content (should be our synth)"
+          echo "Effective GITHUB_EVENT_PATH = ${GITHUB_EVENT_PATH}"
           if [ -f "${GITHUB_EVENT_PATH}" ]; then
-            echo "--- file exists, content: ---"
             cat "${GITHUB_EVENT_PATH}"
           else
             echo "::warning::GITHUB_EVENT_PATH file does not exist"
           fi
           echo "::endgroup::"
-          echo "::group::Synth file at literal path (should match above)"
-          SYNTH="${{ steps.event.outputs.event_path }}"
-          [ -f "${SYNTH}" ] && cat "${SYNTH}" || echo "missing"
-          echo "::endgroup::"
 
       - name: Run reviewdog
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_EVENT_NAME: pull_request
-          GITHUB_EVENT_PATH: ${{ steps.event.outputs.event_path }}
-          GITHUB_SHA: ${{ steps.meta.outputs.head_sha }}
-          GITHUB_REPOSITORY: ${{ steps.meta.outputs.base_repo }}
         run: |
-          # On debug re-runs add reviewdog's own -log-level=debug so the
-          # cienv detection trace is visible alongside the env dump above.
+          # -log-level=debug on debug re-runs for tracing.
           LOG_FLAGS=()
           if [ "${RUNNER_DEBUG}" = "1" ]; then
             LOG_FLAGS+=(-log-level=debug)