Post issue-bot PR comment from a workflow_run workflow

[ondrejmirtes]

Summary

Fixes the issue-bot PR comment failing on fork PRs with 403 Resource not accessible by integration (e.g. this run).

Root cause: the "Issue bot" workflow runs on the pull_request event, and for PRs from forks GitHub forces GITHUB_TOKEN to read-only and withholds secrets — regardless of permissions: — so the comment POST is rejected.

This implements the workflow_run pattern:

• New .github/workflows/issue-bot-pr-comment.yml triggered by workflow_run on completion of "Issue bot". It runs in the base-repo context (writable token + secrets available), so it can comment on fork PRs. It only consumes the pr-comment artifact (comment body + exit-code marker); it never checks out or runs PR code, and resolves the PR number from the trusted workflow_run.head_sha (workflow_run.pull_requests is empty for forks). Posts with PHPSTAN_BOT_TOKEN so the comment comes from the bot account.
• issue-bot.yml: removed the pr-comment-init and pr-comment-finalize jobs and their pull-requests: write grants. The evaluate job still produces the pr-comment artifact; the exit code now travels inside it as a marker file (pr-comment-exit-0 / -2) instead of a job output.
• The push-mode issue commenting (--post-comments to 2.2.x) is unchanged.

Validated locally with actionlint and zizmor --persona=auditor (the workflow_run dangerous-triggers finding is suppressed with an inline ignore, justified by the no-checkout / trusted-SHA design).

Notes / decisions

• Kept permissions: contents: read at the top of issue-bot.yml (it's a read-only hardening default, not a comment-related grant, and removing it would surface security-linter alerts). Removed only the pull-requests: write grants. Say the word if you'd rather drop it entirely.
• Dropped the "mark comment as running at start" behavior. With workflow_run (completed), the comment is posted once, when analysis finishes. It can be re-added via a workflow_run: [requested] trigger if you want it back.

Test plan

• Re-run issue bot on a fork PR that detects changes → comment is posted by the bot account (no 403).
• Same-repo PR with changes → comment posted/updated.
• PR with no changes and no prior comment → nothing posted; with a prior comment → it's updated.
• Push to 2.2.x → per-issue comments still posted via PHPSTAN_BOT_TOKEN.

🤖 Generated with Claude Code