fix(ci): resolve fork PRs when recording the preview deployment

[JSONbored]

Why

Second half of the stuck-preview fix. After #653 (allow .zip), the preview deploy now runs all the way to a live URL — verified on a re-run of PR #635's build:

Validate downloaded artifact -> success
Upload preview version       -> success   (Preview: https://1ddd2740-gittensory-ui.zeronode.workers.dev)
Record deployment for Reviewbot -> FAILURE
##[error]Could not resolve an open PR for d60b5cc9… — skipping deployment record.

The "Record deployment for Reviewbot" step resolves the PR via listPullRequestsAssociatedWithCommit, with workflow_run.pull_requests as a fallback. Both are empty for fork PRs — and most open gittensory PRs originate from forks (635, 651, 650, 649, 637, 634 are all cross-repo). So the step fails and no Deployment / environment_url is ever recorded, leaving Reviewbot's after cell stuck on "Rendering preview…" even though the preview deployed fine.

What

Add a fork-safe resolution fallback: scan open PRs for the one whose head.sha equals this build's GitHub-set head_sha. The base repo tracks the fork head as refs/pull/N/head, so head.sha is trustworthy even for forks (confirmed: pulls.list returns head.sha = d60b5cc9 for fork PR #635). Also adds pull-requests: read for the pulls.list call.

Resolution order now: workflow_run.pull_requests → commit association → open-PR head-SHA match (fork-safe).

Verification

Will re-run a fresh build→deploy for #635 after merge and confirm a preview/pr-635 Deployment with an environment_url is recorded (which then re-triggers Reviewbot to fill in the "after" screenshot).

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#654 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[ghost]

gittensory · advisory review

Reviewed 1 changed file(s) — two independent AI reviewers.

Suggested action: ✅ Safe to merge — both reviewers found no blocking issues.

Reviewer A · gpt-oss-120b — recommends ✅ merge
The PR adds a read permission for pull-requests and improves the logic that resolves the PR number for UI preview deployments, handling forked PRs more robustly. The changes are straightforward, safe, and do not affect application functionality.

Suggestions

• Consider handling pagination beyond the first 100 open PRs in the fallback scan to avoid missing PRs in very active repositories.
• Add a brief comment explaining why the head.sha is trusted even for forked PRs, for future maintainers.

Worth double-checking

• The added pagination call could increase API usage; monitor for rate‑limit impacts on large repos.
• If a repository has more than 100 open PRs, the fallback may miss the correct PR.

Reviewer B · mistral-small-3.1-24b-instruct — recommends ✅ merge
This PR modifies the GitHub Actions workflow to correctly resolve fork PRs when recording preview deployments. The change is clear and addresses a specific issue with handling fork PRs.

Suggestions

• Consider adding comments to explain why the pull-requests: read permission is necessary.
• Ensure that the fallback logic for resolving PRs is thoroughly tested, especially edge cases where multiple PRs might have the same head SHA.

Worth double-checking

• Verify that the fallback logic does not introduce performance issues by scanning all open PRs.
• Ensure that the new logic correctly handles cases where the head SHA might be shared by multiple PRs.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.