fix: drop the re-run helper's pull-requests permission (callers fail at startup)

[michieldegezelle]

Description

Urgent: every LU liquid-test run fails at startup since #63 merged (e.g. lu_market run 37429525996: startup_failure, zero jobs). The required check never reports, so LU PRs are blocked. nl/be would hit the same as soon as they switch.

Cause: #63 gave rerun-losing-run pull-requests: read. A called workflow can't request more than the calling job grants, and callers grant contents: read + actions: write, so GitHub rejects the whole run.

Fix: drop that permission. The PR-closed/moved check now reads the PR's current head from the losing run's own pull_requests field, which the runs API already returns. It lists only open PRs, with their live head (checked on real runs: open PR → current head, merged PR → empty), so no extra API call is needed.

Type of change

• Bug fix
• New feature
• Breaking change

Test plan

• actionlint: no new findings
• lu_market's caller pointed at this branch on a throwaway branch and dispatched (run 37431706411): all 5 jobs created (no startup failure), the helper refused the dummy input as designed, no Slack page. Branch deleted.
• After merge: the next LU PR run starts normally

🤖 Generated with Claude Code

[coderabbitai]

Note

Some coding-guideline sources were skipped; the reason is listed next to each one. Other guidelines were applied as usual. On a public repository, sources from your configuration are listed without their names.

Skipped guideline sources (1)

a configured source — invalid entry; expected repo:path or owner/repo:path with a relative file path

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 4edc3ac7-cc8f-4a29-ae23-fa6f0ba6a01a

📥 Commits

Reviewing files that changed from the base of the PR and between a896208 and 88048eb.

📒 Files selected for processing (1)

• .github/workflows/run_tests_inline_auth.yml

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

📜 Recent review details

🔇 Additional comments (2)

.github/workflows/run_tests_inline_auth.yml (2)

131-131: LGTM!

---

231-231: 🎯 Functional Correctness

The behavior is undecidable from the supplied evidence. The comparison request exited before either API response was obtained because REPO was unset. The evidence therefore does not establish whether an older workflow-run response retains its original embedded PR head after a push.

---

Walkthrough

The workflow removes pull-request read permission from rerun-losing-run. Before rerunning failed jobs, it checks the run’s embedded pull-request head SHA against the run’s head_sha.

Changes

Inline test rerun validation

Layer / File(s)	Summary
Gate reruns on the embedded PR head SHA .github/workflows/run_tests_inline_auth.yml	The workflow grants only actions: write. The helper skips reruns if the run has no embedded pull-request head SHA or if that SHA differs from head_sha.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 88048

This change fixes the startup failure caused by the excess permission request. The remaining uncertainty is whether the embedded PR head stays current after a new push. It is worth confirming on the next LU PR run after merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the permission change and the startup failure it addresses.
Description check	✅ Passed	The description explains the cause, fix, and validation results. It omits the template’s Fixes # reference and README/version/documentation checklist, but is otherwise complete.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}