fix(ci): preserve trusted visual run identity

[cixzhang]

Why

Accepted visual PRs such as #5214 and #5558 cannot merge because immutable visual evidence rejects its own trusted recapture.

The reproduced publisher logs show:

RUN_ID: 33039803616
RUN_ATTEMPT: 2
Error: visual evidence rejected: trusted capture identity mismatch

RUN_ID: 33039815281
RUN_ATTEMPT: 2
Error: visual evidence rejected: trusted capture identity mismatch

pr-comment.yml attempted to replace GITHUB_RUN_ID and GITHUB_RUN_ATTEMPT with those triggering CI identities. GitHub's default GITHUB_* variables are immutable, so gate.mjs instead recorded the PR Comment workflow identities in trusted-capture/manifest.json; publish-pr-report.mjs then correctly rejected the mismatch.

The same required gate had a second live permission blocker on #5162:

DELETE /repos/facebook/astryx/issues/5162/labels/visual-approved - 403
Resource not accessible by integration

Both affected jobs mutate a label on a pull request, so they need job-scoped pull-requests: write; issues: write alone did not authorize that API call.

What

• Pass the triggering CI identity through dedicated ASTRYX_VISUAL_RUN_ID / ASTRYX_VISUAL_RUN_ATTEMPT variables.
• Prefer those variables only when present; normal GitHub and local capture behavior is unchanged.
• Grant PR mutation permission only to the two acceptance jobs that add/remove visual-approved.
• Cover default, trusted override, missing, invalid, workflow wiring, and permission behavior.

Tests

• pnpm exec vitest run .github/scripts/visual-gate — 13 files, 117 tests
• actionlint on the changed workflows (ignoring the existing custom-runner label warning)
• targeted ESLint and Prettier checks
• repository pre-commit checks

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
astryx	Ready	Preview	Aug 27, 2026 6:08am

[github-actions]

PR Analysis Report

📚 Storybook Preview

View Storybook for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

🧪 Sandbox Preview

View Sandbox for this PR
GitHub Pages may take up to a minute to hydrate after deploy.

No new or modified components detected.

Bundle Size Summary

No component packages changed.

Accessibility Audit

Status: No accessibility violations detected.

---

_{Generated by PR Enrichment workflow | Storybook | Sandbox | View full report}

[cixzhang]

Thanks, the run-identity fix reproduces cleanly. One blocker remains: the current head no longer grants pull-requests: write to initialize or accept, so #5162 still gets a 403 deleting visual-approved and required acceptance cannot finish (visual-acceptance.yml:28,210). Please restore the job-scoped permissions and their regression assertion before merge.

[Reviewed by Robohands]

[cixzhang]

Thanks—the blocker is fixed at 1b1e3d89808: both mutation jobs have scoped PR write access, authorization stays read-only, and the identity repro passes. Good to merge.

[Reviewed by Robohands]