ci: add deterministic Isobar maps to PR review signals

.github/workflows/pr-impact.yml

@@ -0,0 +1,133 @@
+name: PR Review Signals
+run-name: 'PR impact map #${{ github.event.pull_request.number }}'
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review, edited]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-review-signals-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      # Only the trusted controller is checked out. PR objects are fetched as
+      # data by collect.mjs; never install dependencies or execute code from them.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          fetch-depth: 0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+      - name: Install trusted analysis tools
+        run: |
+          npm ci --ignore-scripts
+          npm ci --prefix scripts/pr-impact --ignore-scripts
+          python -m venv "$RUNNER_TEMP/isobar-venv"
+          "$RUNNER_TEMP/isobar-venv/bin/pip" install -r scripts/pr-impact/requirements.txt
+          sudo apt-get update
+          sudo apt-get install -y fonts-dejavu
+      - name: Fetch pinned Isobar engine
+        run: |
+          git clone --filter=blob:none --no-checkout https://github.com/r3al1tym/isobar.git "$RUNNER_TEMP/isobar-engine"
+          git -C "$RUNNER_TEMP/isobar-engine" checkout --detach 2ec719904ac7dc30de08e152e4622fe8e02fa57a
+      - name: Compute static review signals
+        env:
+          ISOBAR_UPSTREAM: ${{ runner.temp }}/isobar-engine
+          ISOBAR_PYTHON: ${{ runner.temp }}/isobar-venv/bin/python
+          REVIEW_REPORT_DIRECTORY: ${{ runner.temp }}/review-report
+        run: node --import ./scripts/pr-impact/node_modules/tsx/dist/loader.mjs scripts/pr-impact/collect.mjs
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: review-signals-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/review-report/
+          if-no-files-found: error
+          retention-days: 7
+
+  publish:
+    needs: analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: read
+    # Share the lock with both existing quality publishers so enrichment and
+    # static updates cannot overwrite each other concurrently.
+    concurrency:
+      group: pr-quality-comment-${{ github.event.pull_request.head.repo.id }}-${{ github.event.pull_request.head.ref }}
+      cancel-in-progress: false
+      queue: max
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          sparse-checkout-cone-mode: false
+          sparse-checkout: |
+            /scripts/complexity-report.mjs
+            /scripts/publish-complexity-comment.mjs
+            /scripts/pr-impact/comment.mjs
+            /scripts/pr-impact/publish.mjs
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: review-signals-${{ github.run_attempt }}
+          path: review-report
+      - name: Find latest legacy quality under the publication lock
+        id: latest
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        with:
+          script: |
+            const { legacyQualityArtifact } = await import(
+              `${process.env.GITHUB_WORKSPACE}/scripts/pr-impact/publish.mjs`
+            );
+            const previous = await legacyQualityArtifact({ github, context });
+            if (previous) {
+              core.setOutput('run', previous.runId);
+              core.setOutput('artifact', previous.artifactName);
+            }
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        if: steps.latest.outputs.artifact != ''
+        continue-on-error: true
+        with:
+          name: ${{ steps.latest.outputs.artifact }}
+          path: previous-quality
+          run-id: ${{ steps.latest.outputs.run }}
+          github-token: ${{ github.token }}
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        env:
+          LEGACY_RUN_ID: ${{ steps.latest.outputs.run }}
+          LEGACY_ARTIFACT: ${{ steps.latest.outputs.artifact }}
+        with:
+          script: |
+            const { publishReviewSignals } = await import(
+              `${process.env.GITHUB_WORKSPACE}/scripts/pr-impact/publish.mjs`
+            );
+            await publishReviewSignals({
+              github, context,
+              reportDirectory: `${process.env.GITHUB_WORKSPACE}/review-report`,
+              warn: core.warning,
+              loadLegacyQuality: async (selected) => {
+                if (selected.runId !== Number(process.env.LEGACY_RUN_ID) ||
+                    selected.artifactName !== process.env.LEGACY_ARTIFACT) return null;
+                const { lstat, readFile } = await import("node:fs/promises");
+                const path = `${process.env.GITHUB_WORKSPACE}/previous-quality/comparison.json`;
+                const stat = await lstat(path);
+                if (!stat.isFile() || stat.size > 20 * 1024 * 1024) return null;
+                return JSON.parse(await readFile(path, "utf8"));
+              },
+            });

.github/workflows/pr-quality-comment.yml

@@ -6,13 +6,14 @@ on:
     types: [completed]
 
 permissions:
-  contents: read
+  contents: write
   actions: read
   pull-requests: write
 
 concurrency:
   group: pr-quality-comment-${{ github.event.workflow_run.head_repository.id }}-${{ github.event.workflow_run.head_branch }}
   cancel-in-progress: false
+  queue: max
 
 jobs:
   comment:
@@ -33,6 +34,8 @@ jobs:
           sparse-checkout: |
             /scripts/publish-complexity-comment.mjs
             /scripts/complexity-report.mjs
+            /scripts/pr-impact/comment.mjs
+            /scripts/pr-impact/publish.mjs
       - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         id: artifacts
         with:
@@ -45,7 +48,7 @@ jobs:
               github, repo: context.repo, runId: run.id, attempt: run.run_attempt,
             });
             core.setOutput('report', names.report);
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: steps.artifacts.outputs.report != ''
         continue-on-error: true
         with:

.github/workflows/pr-quality.yml

@@ -148,23 +148,26 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
-      contents: read
+      contents: write
       actions: read
       pull-requests: write
     concurrency:
       group: pr-quality-comment-${{ github.event.pull_request.head.repo.id }}-${{ github.event.pull_request.head.ref }}
       cancel-in-progress: false
+      queue: max
     steps:
-      # Same-repository authors already control this PR workflow. Forks and
-      # Dependabot use the default-branch publisher in pr-quality-comment.yml.
+      # Publish with default-branch code only, including for same-repository PRs.
+      # Contributor code runs only in the read-token analysis/test jobs.
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.sha }}
+          ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
           sparse-checkout-cone-mode: false
           sparse-checkout: |
             /scripts/publish-complexity-comment.mjs
             /scripts/complexity-report.mjs
+            /scripts/pr-impact/comment.mjs
+            /scripts/pr-impact/publish.mjs
       - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         id: artifacts
         with:
@@ -177,7 +180,7 @@ jobs:
               attempt: Number(process.env.GITHUB_RUN_ATTEMPT),
             });
             core.setOutput('report', names.report);
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: steps.artifacts.outputs.report != ''
         continue-on-error: true
         with:
@@ -224,13 +227,13 @@ jobs:
             });
             core.setOutput('base', names.base);
             core.setOutput('pr', names.pr);
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: steps.artifacts.outputs.base != ''
         continue-on-error: true
         with:
           name: ${{ steps.artifacts.outputs.base }}
           path: coverage-input/base
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         if: steps.artifacts.outputs.pr != ''
         continue-on-error: true
         with:

.gitignore

@@ -78,3 +78,9 @@ reports/dependency/
 
 # Local cognitive-complexity analysis
 reports/complexity/
+
+# Generated Isobar previews and local tooling
+.isobar/previews/
+.isobar/upstream/
+scripts/pr-impact/.venv/
+scripts/pr-impact/__pycache__/