fix(ci): go-benchmark GH permissions

[gregfurman]

Description

The go benchmark job does not pass in a required GH token, causing the PR commenting step to always fail with a 403.

See example CI failure :

POST /repos/hatchet-dev/hatchet/issues/4189/comments - 403 with id BFC2:16B58E:136CAB9:12A2CA5:6A2FEF57 in 239ms
RequestError [HttpError]: Resource not accessible by integration - https://docs.github.com/rest/issues/comments#create-an-issue-comment
    at fetchWrapper (/home/runner/work/_actions/actions/github-script/3a2844b7e9c422d3c10d287c895573f7108da1b3/dist/index.js:61509:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
    at async eval (eval at callAsyncFunction (/home/runner/work/_actions/actions/github-script/3a2844b7e9c422d3c10d287c895573f7108da1b3/dist/index.js:64949:16), <anonymous>:48:3)

Type of change

• Bug fix (non-breaking change which fixes an issue)
• CI (any automation pipeline changes)

What's Changed

• Supplies required GH token to PR comment step

Checklist

Changes have been:

• Tested (unit, integration, or manually with steps specified)
• Linted and formatted
• Documented (where applicable)
• Added to CHANGELOG (where applicable) -- see Keep a Changelog

---

🤖 AI Disclosure

• I acknowledge that an LLM was used in the creation of this Pull Request, in accordance with Hatchet's AI_POLICY.md.

• Details: [e.g. generating tests, writing docs]

[vercel]

@gregfurman is attempting to deploy a commit to the Hatchet Team on Vercel.

A member of the Team first needs to authorize it.

[BloggerBust]

Hey @gregfurman I have reviewed and would like to suggest a couple of approaches.

The failing run (#4189) is from a fork, which is the cause here. On a fork PR, GITHUB_TOKEN is read-only regardless of the permissions: block, so issues.createComment returns 403. The job already has pull-requests: write, and has since the workflow was added, and actions/github-script already uses the workflow token by default. So github-token: ${{ secrets.GITHUB_TOKEN }} passes the same read-only token and changes nothing.

Options to handle fork PRs:

1. Guard the comment step so a fork does not fail the job. Skip it when github.event.pull_request.head.repo.full_name != github.repository, or set continue-on-error: true. Smallest change, but fork PRs get no benchmark comment.
2. Split the work. Run the benchmark on pull_request (read-only) and upload the result as an artifact, then post the comment from a workflow_run workflow, which runs in the base repo context with a write token. Fork PRs get the comment, and no fork code runs with write access.

[gregfurman]

@BloggerBust Thanks for reviewing! The workflow run approach seems best but feels like overkill considering we have only now run into this issue.

Perhaps worth considering whether we actually need comments or whether the benchmarks changing by some factor should actually just fail the job -- with the full table being printed as ASCII in the job's console output.

[gregfurman]

I'll close this in any case since this is not actually fixing anything 🤦