ci: post code-review-graph comments from a trusted workflow_run

[neomatrix369]

Summary

• Split Code Review Graph so analysis stays unprivileged and the sticky PR comment is posted from a trusted workflow_run on main.
• Fork pull_request runs get a read-only GITHUB_TOKEN, which made the in-job Upsert sticky PR comment step 403 on PR #63.

Why

Same-repo PRs already succeeded. Contributor fork PRs cannot write comments from the analysis job; publishing from the default branch restores the sticky comment without pull_request_target.

Test Results

Backend

Tests: 128 passed, 0 failed, 0 skipped (0.40s)

Coverage:

Module / Package	Statements	Branches
sandbox/init.py	100.0%	—
sandbox/scan_app.py	89.6%	88.1%
sandbox/scanners.py	98.8%	98.1%
Total	96.2%	96.0%

Frontend

Tests: 55 passed, 0 failed, 0 skipped (3.05s)

Coverage:

Module / Package	Statements	Branches	Methods
bin/tripwire.js	96.49%	63.63%	100%
src/	98.87%	87.07%	100%
Total	98.6%	85.71%	100%

Quality Gates

Complexity

Stack	Tool	Result	Status
Python	xenon	scan_app ≤C / scanners ≤D (CI ceilings)	✅

Static Analysis

Stack	Tool	Status
Python	ruff + mypy	✅ clean

Security

Tool	Status
gitleaks (branch range)	✅ no secrets found

Checklist

• ./scripts/quality-gates.sh passes locally
• New tests added or updated (or change is docs-only)
• Docs updated where applicable
• No secrets or credentials committed

Made with Cursor