fix: allow nightly scan when PR creation is blocked

[Mani Bindra (maniSbindra)]

Summary

Handle the repository limitation where GitHub Actions can push the nightly results branch with GITHUB_TOKEN but cannot create or update pull requests.

Relates to #6

Changes

• keep pushing nightly-scan-results as before
• attempt to create or update the PR
• if GitHub blocks that action, emit a manual PR link in the workflow summary instead of failing the nightly run
• preserve existing behavior for unexpected gh pr failures by still failing the job

Why

The latest nightly run failed after successfully pushing the results branch with:

GraphQL: GitHub Actions is not permitted to create or approve pull requests (createPullRequest)

This change keeps the nightly scan usable until a GitHub App or different permission model is available.

[Copilot]

Pull request overview

This PR updates the nightly scan GitHub Actions workflow to gracefully handle repositories where GITHUB_TOKEN can push the results branch but is blocked from creating/updating PRs, by emitting a manual PR link in the workflow summary instead of failing the run.

Changes:

• Add a helper to write a workflow summary and warnings when PR creation/update is blocked by GitHub policy.
• Wrap gh pr create / gh pr edit to detect the “not permitted to create or approve pull requests” error and degrade gracefully.
• Preserve failure behavior for other unexpected gh pr errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Mani Bindra (maniSbindra)]

Copilot please review after last commit

[Copilot]

Copilot please review after last commit

The previous review feedback is addressed in commit ae2e1b7. The emit_manual_pr_summary function now accepts an optional action_url and action_label, and the gh pr edit fallback passes the existing PR URL (/pull/${EXISTING_PR}) with label "Review existing PR manually" — so the summary links to the open PR rather than a new-PR creation page. All CI checks (CI, Lint, Dependency Review, Scan Smoke Test) are passing on this commit.