CI sets

.github/actions/update-ci-report/action.yml

@@ -0,0 +1,66 @@
+name: Update CI report
+description: Render all available task fragments and update the unified check/comment
+
+inputs:
+  run-dir:
+    description: Per-run CI state directory
+    required: true
+  fallback-conclusion:
+    description: Conclusion when no plan or fragments survived
+    required: false
+    default: failure
+  app-id:
+    description: GitHub App ID for cross-repository reports
+    required: false
+  app-private-key:
+    description: GitHub App private key for cross-repository reports
+    required: false
+
+runs:
+  using: composite
+  steps:
+    - name: Render report snapshot
+      shell: bash
+      env:
+        CI_RUN_DIR: ${{ inputs.run-dir }}
+      run: |
+        python3 scripts/ci/report/render.py \
+          --plan "$CI_RUN_DIR/plan.json" \
+          --fragments "$CI_RUN_DIR/fragments" \
+          --fallback-conclusion '${{ inputs.fallback-conclusion }}' \
+          --md-out "$CI_RUN_DIR/report/report.md" \
+          --json-out "$CI_RUN_DIR/report/report.json"
+
+    - name: Resolve report destination
+      id: origin
+      shell: bash
+      env:
+        CI_RUN_DIR: ${{ inputs.run-dir }}
+      run: |
+        python3 scripts/ci/origin.py token-target \
+          --input "$CI_RUN_DIR/origin.json" \
+          --allowed-owner "$GITHUB_REPOSITORY_OWNER" \
+          --github-output "$GITHUB_OUTPUT"
+
+    - name: Mint report token
+      id: report-token
+      if: steps.origin.outputs.external == 'true'
+      uses: actions/create-github-app-token@v3
+      with:
+        app-id: ${{ inputs.app-id }}
+        private-key: ${{ inputs.app-private-key }}
+        owner: ${{ steps.origin.outputs.owner }}
+        repositories: ${{ steps.origin.outputs.repository }}
+        permission-checks: write
+        permission-issues: write
+        permission-pull-requests: read
+
+    - name: Publish report snapshot
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        CI_RUN_DIR: ${{ inputs.run-dir }}
+      with:
+        github-token: ${{ steps.report-token.outputs.token || github.token }}
+        script: |
+          const post = require('${{ github.workspace }}/scripts/ci/report/post.js');
+          await post({github, context, core});