fix(ci): post WASM size report via workflow_run, not pull_request

pull_request-triggered workflows get a read-only GITHUB_TOKEN for
cross-repo (fork) PRs no matter what permissions: is declared, so the
direct comment POST from wasm-size-report was failing with a 403.

wasm-size-report now just writes the size data to JSON and uploads it
as an artifact (no write permissions needed). A new workflow_run-
triggered workflow (wasm-size-comment.yml), which runs in the base
repo's context, downloads that artifact and posts/updates the PR
comment. It never checks out or executes PR-supplied code, so it
avoids the pull_request_target "pwn request" risk that would come
from building untrusted contract source with a write-scoped token.

Author: Mrwicks00

.github/workflows/contracts.yml

@@ -103,10 +103,6 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
 
-    permissions:
-      contents: read
-      pull-requests: write
-
     steps:
       - name: Checkout PR head
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -163,38 +159,28 @@ jobs:
           SIZE=$(wc -c < "${{ github.workspace }}/.wasm-size-target/wasm32-unknown-unknown/release/stellar_contracts.wasm" | tr -d '[:space:]')
           echo "size=$SIZE" >> "$GITHUB_OUTPUT"
 
-      - name: Comment size report on PR
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      - name: Write size report
+        run: |
+          cat > wasm-size-report.json <<EOF
+          {
+            "pr_number": ${{ github.event.pull_request.number }},
+            "base_sha": "${{ github.event.pull_request.base.sha }}",
+            "head_sha": "${{ github.event.pull_request.head.sha }}",
+            "base_size": ${{ steps.base_size.outputs.size }},
+            "head_size": ${{ steps.head_size.outputs.size }},
+            "limit": ${{ env.MAX_WASM_BYTES }}
+          }
+          EOF
+
+      # PRs from forks get a read-only GITHUB_TOKEN under the `pull_request`
+      # event, so this job can't post a comment directly. The report is
+      # handed off as an artifact to wasm-size-comment.yml, which runs via
+      # `workflow_run` in the base repo's context (write-capable token) and
+      # only ever reads this JSON — it never checks out or executes PR code,
+      # so it stays safe from a malicious PR's build script.
+      - name: Upload size report artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
-          script: |
-            const headSize = ${{ steps.head_size.outputs.size }};
-            const baseSize = ${{ steps.base_size.outputs.size }};
-            const limit = ${{ env.MAX_WASM_BYTES }};
-            const delta = headSize - baseSize;
-            const deltaStr = `${delta > 0 ? '+' : ''}${delta.toLocaleString()} bytes`;
-            const pct = ((headSize / limit) * 100).toFixed(1);
-            const marker = '<!-- wasm-size-report -->';
-
-            const body = [
-              marker,
-              '### Contract WASM size report',
-              '',
-              '| | Bytes |',
-              '|---|---|',
-              `| Base (\`${context.payload.pull_request.base.sha.slice(0, 7)}\`) | ${baseSize.toLocaleString()} |`,
-              `| Head (\`${context.payload.pull_request.head.sha.slice(0, 7)}\`) | ${headSize.toLocaleString()} |`,
-              `| Delta | ${deltaStr} |`,
-              `| Budget used | ${pct}% of ${limit.toLocaleString()} bytes |`,
-            ].join('\n');
-
-            const { owner, repo } = context.repo;
-            const issue_number = context.issue.number;
-
-            const comments = await github.rest.issues.listComments({ owner, repo, issue_number });
-            const existing = comments.data.find((c) => c.body.includes(marker));
-
-            if (existing) {
-              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
-            } else {
-              await github.rest.issues.createComment({ owner, repo, issue_number, body });
-            }
+          name: wasm-size-report
+          path: wasm-size-report.json
+          retention-days: 7

.github/workflows/wasm-size-comment.yml

@@ -0,0 +1,68 @@
+name: WASM Size Comment
+
+# Runs in the base repo's context (not the PR head's), so it gets a
+# write-capable GITHUB_TOKEN even for PRs from forks. It never checks out
+# or executes any code from the PR — it only downloads the small JSON
+# artifact produced by the `wasm-size-report` job in contracts.yml and
+# posts/updates a PR comment from it.
+on:
+  workflow_run:
+    workflows: ["Smart Contract CI"]
+    types: [completed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  comment:
+    name: Post size comment
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.event == 'pull_request'
+
+    steps:
+      - name: Download size report artifact
+        id: download
+        continue-on-error: true
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: wasm-size-report
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Post or update comment
+        if: steps.download.outcome == 'success'
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        with:
+          script: |
+            const fs = require('fs');
+            const report = JSON.parse(fs.readFileSync('wasm-size-report.json', 'utf8'));
+
+            const delta = report.head_size - report.base_size;
+            const deltaStr = `${delta > 0 ? '+' : ''}${delta.toLocaleString()} bytes`;
+            const pct = ((report.head_size / report.limit) * 100).toFixed(1);
+            const marker = '<!-- wasm-size-report -->';
+
+            const body = [
+              marker,
+              '### Contract WASM size report',
+              '',
+              '| | Bytes |',
+              '|---|---|',
+              `| Base (\`${report.base_sha.slice(0, 7)}\`) | ${report.base_size.toLocaleString()} |`,
+              `| Head (\`${report.head_sha.slice(0, 7)}\`) | ${report.head_size.toLocaleString()} |`,
+              `| Delta | ${deltaStr} |`,
+              `| Budget used | ${pct}% of ${report.limit.toLocaleString()} bytes |`,
+            ].join('\n');
+
+            const { owner, repo } = context.repo;
+            const issue_number = report.pr_number;
+
+            const comments = await github.rest.issues.listComments({ owner, repo, issue_number });
+            const existing = comments.data.find((c) => c.body.includes(marker));
+
+            if (existing) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            }