Commit results to fork PRs with an optional fork-push token

[alexey-milovidov]

Summary

• collect-results.yml could only commit result files to PR branches in this repository: its GITHUB_TOKEN is scoped to ClickHouse/ClickBench, and GitHub grants the "allow edits from maintainers" push permission only to user accounts with write access — never to App installation tokens. Fork PRs (e.g. update: Sail to 0.6.6 #982) got a pastila.nl link and a request to save the file by hand.
• The collector now commits results directly to fork PRs whose author allows maintainer edits (maintainer_can_modify), authenticating with the org-level ROBOT_CLICKHOUSE_COMMIT_TOKEN secret, which is already shared with this repository — no new secret or machine account needed, and no new exposure (the secret was already readable by this repo's workflows).
• Details:
  • The fork push clears the http.https://github.com/.extraheader that actions/checkout stores in the git config — it carries the GITHUB_TOKEN and would be sent to the fork and rejected — and supplies the PAT through an inline credential helper that reads the environment variable, so the token never appears in a command line or an error message.
  • If the push fails (no write access, the author unticked the box meanwhile, the branch moved, the fork protects it), the old paste-link fallback is posted instead of failing the PR.
  • When the token is configured but maintainer edits are off, the comment asks the author to tick "Allow edits by maintainers".
  • Organization-owned forks never allow maintainer edits, so they always get the paste-link fallback.

Setup after merge

robot-clickhouse currently has read-only access to this repository, and the maintainer-edit fork push requires write access to the base repo. Grant it:

gh api -X PUT repos/ClickHouse/ClickBench/collaborators/robot-clickhouse -f permission=push

Until then, the behavior is unchanged (fork pushes fail gracefully to paste links).

Test plan

• git credential fill confirms the inline helper hands the token from the environment to git
• fetch_branch fetches PR update: Sail to 0.6.6 #982's head straight from the fork's public URL
• commit_results (DRY_RUN) builds the result commit on top of the fork head and targets the fork remote
• Gate verified against PR update: Sail to 0.6.6 #982 metadata: fork_push is true with the token set, false without it
• ROBOT_CLICKHOUSE_COMMIT_TOKEN confirmed visible to this repository (org secret list)
• Tested end to end on PR update: Sail to 0.6.6 #982: the workflow (dispatched from this branch) fetched the 14 result files from the paste links and pushed them to the author's fork as d6de6f2d4e — robot-clickhouse now has write access, and the maintainer-edit push works

🤖 Generated with Claude Code