fix(ci): resolve fork PRs by open-PR head SHA, not commit association - #3922

Fork PR e2e lane never ran. resolve looks up PR for head sha with listPullRequestsAssociatedWithCommit on base repo, and this endpoint returns nothing for fork PR head, because fork commit reaches base repo only as refs/pull/<n>/head and association index doesn't walk refs/pull/*. So every fork PR failed closed on expected exactly one open PR for <sha>, found 0, got red required E2E Tests that its author cant clear by pushing, and publish, e2e, report skipped.

Endpoint works fine for same-repo heads, that is why nobody saw it - same-repo PRs get E2E Tests from pull-requests.yaml and never enter this workflow at all. Of 935 runs of E2E (fork) 930 skipped as designed, and all 5 that reached resolve stopped right there (three on found 0, one on genuinely failed fork build). One of those reds was later overwritten by mirrored same-repo run, so symptom got hidden second time.

Checked on live api: on base repo that endpoint returns 0 for head sha of all 5 currently open fork PRs and 1 for same-repo PRs, on fork repo it returns 1 for same commit. Listing open PRs of base repo and matching head sha returns 1.

Fix

const openPrs = await github.paginate(
  github.rest.pulls.list,
  { owner, repo, state: 'open', per_page: 100 },
);
const open = openPrs.filter(p => p.head && p.head.sha === HEAD_SHA);

Same trust properties as call it replaces, this is plain base-repo api data that fork cannot forge, and asking state: 'open' at source keeps old rule that closed or merged PR never counts. Exactly-one guard and head sha match are not changed, so stacked lower PR whose head is only contained in upper branch still passes, and two PRs really sitting at same head still fail closed. Pagination becomes load bearing here, repo has 180 open PRs and fork PR that surfaced this sits on page two.

Most of diff is the comment block, rewritten so association call doesn't come back later as an optimization.

Simulated new logic on live api, failing head resolves to exactly one open PR and labels are present in list payload, so full-e2e override still reads. actionlint, zizmor, node --check on extracted script and pre-commit pass.

What is not verified

publish, e2e and report never executed in this workflow, so first fork PR going through the gate will exercise them for the first time. I would watch digest push from OCI archives and HEAD^2 == head_sha assert. Also there is no test harness for inline resolve script and this PR doesn't add one.

Summary by CodeRabbit

• Bug Fixes
  • Improved fork pull request detection by matching the exact triggering commit.
  • Prevented stacked or unrelated pull requests containing the same commit from being incorrectly selected.
  • Ensured the workflow proceeds only when exactly one matching open pull request is found.