Publish the ABI check comment and labels via

.github/workflows/abi-report.yaml

@@ -0,0 +1,34 @@
+# Publishes the result of the "abi" workflow (abi.yaml) on the pull request:
+# one sticky comment with the per-library ABI verdicts and the
+# "ABI compatible" / "ABI break" label.
+#
+# This is a separate workflow because abi.yaml builds and diffs the pull
+# request's own code. For pull requests from forks GitHub therefore runs it
+# with a read-only token, whatever permissions it asks for, and it cannot
+# write to the PR. workflow_run workflows instead run the workflow file from
+# the default branch of this repository with a normal token; this one never
+# checks out or executes anything from the pull request, it only downloads the
+# report artifacts the abi run uploaded and posts what they say.
+#
+# The pass/fail check on the pull request still comes from abi.yaml; this
+# workflow only adds the comment and the label. It only starts firing once it
+# exists on the default branch, and a first-time contributor's abi run still
+# needs a maintainer's approval before anything is published.
+#
+# See https://github.com/fujitatomoya/ros2-abi-action for details.
+name: abi-report
+
+on:
+  workflow_run:
+    # Must match the `name:` of abi.yaml.
+    workflows: [abi]
+    types: [completed]
+
+jobs:
+  report:
+    permissions:
+      contents: read
+      pull-requests: write   # sticky comment + label
+      issues: write          # label
+      actions: read          # download the abi run's report artifacts
+    uses: fujitatomoya/ros2-abi-action/.github/workflows/report.yml@main

.github/workflows/abi.yaml

@@ -21,7 +21,15 @@
 #      fujitatomoya/libabigail-action (abidiff), one job per library,
 #   5. applies REP-0009 policy automatically: released distros (humble/jazzy/kilted/lyrical)
 #      fail on an incompatible ABI break, rolling is advisory only,
-#   6. surfaces per-library verdicts as sticky PR comments, labels, and a pass/fail check.
+#   6. surfaces the verdict as a pass/fail check and uploads one report bundle
+#      (abidiff report + verdict.json) per library.
+#
+# The sticky PR comment and the "ABI compatible" / "ABI break" labels are NOT
+# posted from here (publish: workflow-run). Most rclcpp pull requests come from
+# forks, and on pull_request events from a fork GitHub gives this workflow a
+# read-only token regardless of the permissions requested below, so any write
+# to the PR would fail. abi-report.yaml runs on workflow_run once this workflow
+# completes and publishes the comment and labels with a token that may write.
 #
 # Paired changes in other repositories (e.g. an rcl PR this PR depends on) are
 # declared by the PR author in the PR description and applied to the PR side
@@ -41,10 +49,10 @@ on:
 
 jobs:
   abi:
+    # Nothing is written to the pull request from this workflow; the report
+    # workflow holds the write permissions.
     permissions:
       contents: read
-      pull-requests: write
-      issues: write
     uses: fujitatomoya/ros2-abi-action/.github/workflows/check.yml@main
     with:
       # Colcon package names to build (whitespace-separated); no single package
@@ -63,3 +71,6 @@ jobs:
       distro: auto
       # auto -> REP-0009: strict on released distros, advisory on rolling.
       policy: auto
+      # Leave the PR comment and labels to abi-report.yaml (workflow_run), so
+      # pull requests from forks get them too.
+      publish: workflow-run