ci: publish sticky benchmark comments

[deepso7]

Closes #139.

What changed

• publish Bench comparison artifacts from an isolated workflow_run workflow
• validate the artifact PR number and current PR head SHA before using write permissions
• update one marker-based comment through gh api, with serialized writes per PR branch
• preserve the last successful comparison under a failure or timeout banner
• leave comments untouched for cancelled runs

Validation

• actionlint .github/workflows/bench-comment.yml
• git diff --check

The full comment path cannot run until this workflow exists on main, as noted in #139.

---

Summary by cubic

Adds a workflow_run workflow that posts a sticky benchmark comparison comment on pull requests, closing #139. Only benchmark runs triggered by a pull request are considered, so baseline runs are skipped.

• Downloads the comparison artifact from the completed Bench workflow.
• Validates the artifact's PR number and head SHA before writing.
• On failed or timed-out runs, preserves the last successful comparison under a warning banner linking to the failed run, even when no artifact was produced.
• Cancelled runs are skipped.
• Concurrency group serializes comment updates per branch to avoid race conditions.
• The full comment path can't be tested until this workflow is merged to main, as noted in Bench comment: sticky PR upsert via workflow_run #139.

^{Written for commit 3c570dd. Summary will update on new commits.}

[greptile-apps]

Greptile Summary

This PR adds an isolated workflow_run workflow that validates benchmark artifacts and upserts a serialized sticky PR comment.

• Downloads the comparison artifact from the triggering Bench run and validates its PR number and current head SHA.
• Updates a marker-based comment through gh api.
• Attempts to preserve the last successful comparison beneath failure and timeout banners while ignoring cancelled runs.

Confidence Score: 4/5

The workflow should not be merged until failed or timed-out runs can update the sticky comment even when no comparison artifact was produced.

The new job reaches its banner-generation logic only after a mandatory artifact download, while producer timeout and compare-job failure paths can omit that artifact and leave a stale successful comment untouched.

Files Needing Attention: .github/workflows/bench-comment.yml

Important Files Changed

Filename	Overview
.github/workflows/bench-comment.yml	Adds the privileged sticky-comment workflow, but its failure-banner path is blocked when the triggering run does not produce an artifact.

Sequence Diagram

sequenceDiagram
  participant B as Bench workflow
  participant A as Artifact store
  participant C as Bench comment workflow
  participant P as Pull request
  B->>A: Upload comparison and PR number
  B-->>C: workflow_run completed
  C->>A: Download artifact by run ID
  alt Artifact is available and valid
    C->>P: Validate current head SHA
    C->>P: Create or update sticky comment
  else Artifact was not produced
    A-->>C: Download failure
    Note over C,P: Warning banner is never published
  end

Loading

_{Reviews (1): Last reviewed commit: "ci: publish sticky benchmark comments" | Re-trigger Greptile}

[cubic-dev-ai]

All reported issues were addressed

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>