From cebfb99792e9a1657952597b395ca5bb859b8054 Mon Sep 17 00:00:00 2001
From: ainta <ainta98@gmail.com>
Date: Fri, 26 Jun 2026 08:49:52 -0400
Subject: [PATCH] ci: keep build timing report non-blocking when PR comment
 fails

The "Upsert build timing PR comment" step throws on any GitHub API error,
which fails the whole Build Timing Report job. In practice the comment call
returns HTTP 403 "Resource not accessible by integration": this is a
`workflow_run` job, so GITHUB_TOKEN is capped at the repository's default
token permissions and the `issues: write` declared in the workflow cannot
take effect. The rendered report is already attached to the job summary, so
the comment is cosmetic, yet the failure shows up as a red X on green CI.

Wrap the comment upsert in try/catch: on failure emit a core.warning (with a
pointer to the Actions workflow-permission setting on 403) and let the job
finish green. No behavior change when the comment posts successfully.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build-timing-report.yml | 63 +++++++++++++++--------
 1 file changed, 42 insertions(+), 21 deletions(-)

diff --git a/.github/workflows/build-timing-report.yml b/.github/workflows/build-timing-report.yml
index 0b01beaf36..586dcd1439 100644
--- a/.github/workflows/build-timing-report.yml
+++ b/.github/workflows/build-timing-report.yml
@@ -247,26 +247,47 @@ jobs:
             const body = fs.readFileSync(process.env.BUILD_TIMING_COMMENT, 'utf8');
             const { owner, repo } = context.repo;
             const issue_number = Number('${{ steps.timing-context.outputs.pr-number }}');
-            const comments = await github.paginate(
-              github.rest.issues.listComments,
-              { owner, repo, issue_number, per_page: 100 }
-            );
-            const existing = comments.find(comment =>
-              comment.user?.type === 'Bot' && comment.body?.includes(marker)
-            );
 
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner,
-                repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner,
-                repo,
-                issue_number,
-                body,
-              });
+            try {
+              const comments = await github.paginate(
+                github.rest.issues.listComments,
+                { owner, repo, issue_number, per_page: 100 }
+              );
+              const existing = comments.find(comment =>
+                comment.user?.type === 'Bot' && comment.body?.includes(marker)
+              );
+
+              if (existing) {
+                await github.rest.issues.updateComment({
+                  owner,
+                  repo,
+                  comment_id: existing.id,
+                  body,
+                });
+              } else {
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number,
+                  body,
+                });
+              }
+            } catch (error) {
+              // The rendered report is already attached to the job summary (see the
+              // previous step), so failing to post the PR comment must not fail this
+              // reporting job and surface as a red X on otherwise-green CI.
+              if (error.status === 403) {
+                core.warning(
+                  'Could not post the build timing PR comment: GITHUB_TOKEN is not ' +
+                  'permitted to write issue comments (HTTP 403 "Resource not accessible ' +
+                  'by integration"). For `workflow_run` jobs the token is capped at the ' +
+                  'repository default, so the `issues: write` permission declared in this ' +
+                  'workflow cannot take effect until write access is enabled under ' +
+                  'Settings → Actions → General → Workflow permissions ' +
+                  '(or a token/app granting `issues: write` is provided). The report is ' +
+                  'still available in the job summary above.'
+                );
+              } else {
+                core.warning(`Could not post the build timing PR comment: ${error.message}`);
+              }
             }