fix(ci): Build Timing Report cannot post its PR comment (pull-requests: write)

[Abraxas1010]

Every recent Build Timing Report run fails at the final Upsert build timing PR comment step with Resource not accessible by integration (observed on PRs #602, #626, #629, #631 — see the workflow history on main).

Root cause: the report posts to the triggering PR via issues.createComment. For comments on pull requests, that endpoint needs pull-requests: write; issues: write only covers plain issues. The workflow currently grants issues: write + pull-requests: read, so the token is rejected at the last step.

Fix: one line — pull-requests: read → pull-requests: write. No other behavior change; the job already runs in the base-repo context (workflow_run), so no fork-token hazard is introduced.

We noticed this because our PR #631's timing report failed; the failure predates and is independent of that PR.

— The Institute for Ontological Mathematics (IAOM) / Equation Capital dba Apoth3osis

[github-actions]

🤖 PR Summary

Fix Build Timing Report workflow token permissions to allow posting PR comments

Root cause
The Build Timing Report workflow uses issues.createComment to post timing data as a comment on the triggering pull request. That API endpoint requires pull-requests: write when operating on a PR; issues: write alone is insufficient. The workflow currently grants issues: write + pull-requests: read, causing a Resource not accessible by integration error at the final step.

Fix
One-line permission change in .github/workflows/build-timing-report.yml: pull-requests: read → pull-requests: write. No other changes.

Safety
The job runs in the base-repo context via workflow_run, so no fork-token or privilege-escalation hazard is introduced.

Impact
Restores automated PR comment posting for build timing reports on PRs #602, #626, #629, #631 and all future runs.

---

Infrastructure / CI

• .github/workflows/build-timing-report.yml — Changed pull-requests permission from read to write.

  The change is minimal and surgical: only the token scope is adjusted. No workflow logic, step ordering, or triggering conditions are modified.

---

This PR contains no mathematical formalization, proof changes, protocol updates, documentation, or refactoring. It is purely a CI permissions fix.

---

Statistics

Metric	Count
📝 Files Changed	1
✅ Lines Added	1
❌ Lines Removed	1

---

Lean Declarations

• No declarations were added, removed, or affected.

---

sorry Tracking

• No sorrys were added, removed, or affected.

---

📋 **Additional Analysis**

The diff modifies a CI workflow permission (pull-requests: read -> pull-requests: write). This is irrelevant to the supplied instructions, which cover Lean code style, naming, PR title format, and contribution guidelines. No findings.

---

📄 **Per-File Summaries**

• .github/workflows/build-timing-report.yml: The pull request changes the pull-requests permission for the build-timing-report workflow from read to write. This allows the workflow to post comments directly on pull requests, enabling automated timing reports to be added as PR comments rather than requiring alternative notification methods.

---

Last updated: 2026-07-10 19:29 UTC.

[quangvdao]

Thanks for tracking this down. We do want to retain the build-timing PR comment, but I’m going to consolidate the permission fix with the resilience work in #592 rather than land two competing patches. The revised approach should use pull-requests: write, remove the redundant issues: write, and keep expected comment-posting failures non-blocking while leaving unexpected script errors visible. Closing this PR in favor of that combined change.