[red-knot] mypy_primer: comment on PRs (#16599)

## Summary

Add a new pipeline to comment on PRs if there is a mypy_primer diff
result.

## Test Plan

Not yet, I'm afraid I will have to merge this first to have the pipeline
available on main.

.github/workflows/mypy_primer.yaml

@@ -59,11 +59,27 @@ jobs:
 
           echo "Running mypy_primer"
 
-          uvx --from "git+https://github.com/astral-sh/mypy_primer.git@add-red-knot-support" mypy_primer \
-            --repo ruff \
-            --type-checker knot \
-            --old base_commit \
-            --new "$GITHUB_SHA" \
-            --project-selector '/(mypy_primer|black|pyp|git-revise|zipp|arrow)$' \
-            --output concise \
-            --debug
+          (
+            uvx --from "git+https://github.com/astral-sh/mypy_primer.git@add-red-knot-support" mypy_primer \
+              --repo ruff \
+              --type-checker knot \
+              --old base_commit \
+              --new "$GITHUB_SHA" \
+              --project-selector '/(mypy_primer|black|pyp|git-revise|zipp|arrow)$' \
+              --output concise \
+              --debug | tee mypy_primer.diff
+          ) || [ $? -eq 1 ]
+
+          echo ${{ github.event.number }} > pr-number
+
+      - name: Upload diff
+        uses: actions/upload-artifact@v4
+        with:
+          name: mypy_primer_diff
+          path: mypy_primer.diff
+
+      - name: Upload pr-number
+        uses: actions/upload-artifact@v4
+        with:
+          name: pr-number
+          path: pr-number

.github/workflows/mypy_primer_comment.yaml

@@ -0,0 +1,89 @@
+name: PR comment (mypy_primer)
+
+on: # zizmor: ignore[dangerous-triggers]
+  workflow_run:
+    workflows: [Run mypy_primer]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      workflow_run_id:
+        description: The mypy_primer workflow that triggers the workflow run
+        required: true
+
+jobs:
+  comment:
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: dawidd6/action-download-artifact@v8
+        name: Download PR number
+        with:
+          name: pr-number
+          run_id: ${{ github.event.workflow_run.id ||  github.event.inputs.workflow_run_id }}
+          if_no_artifact_found: ignore
+          allow_forks: true
+
+      - name: Parse pull request number
+        id: pr-number
+        run: |
+          if [[ -f pr-number ]]
+          then
+            echo "pr-number=$(<pr-number)" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: dawidd6/action-download-artifact@v8
+        name: "Download mypy_primer results"
+        id: download-mypy_primer_diff
+        if: steps.pr-number.outputs.pr-number
+        with:
+          name: mypy_primer_diff
+          workflow: mypy_primer.yaml
+          pr: ${{ steps.pr-number.outputs.pr-number }}
+          path: pr/mypy_primer_diff
+          workflow_conclusion: completed
+          if_no_artifact_found: ignore
+          allow_forks: true
+
+      - name: Generate comment content
+        id: generate-comment
+        if: steps.download-mypy_primer_diff.outputs.found_artifact == 'true'
+        run: |
+          # Guard against malicious mypy_primer results that symlink to a secret
+          # file on this runner
+          if [[ -L pr/mypy_primer_diff/mypy_primer.diff ]]
+          then
+              echo "Error: mypy_primer.diff cannot be a symlink"
+              exit 1
+          fi
+
+          # Note this identifier is used to find the comment to update on
+          # subsequent runs
+          echo '<!-- generated-comment mypy_primer -->' >> comment.txt
+
+          echo '## `mypy_primer` results' >> comment.txt
+          echo '```diff' >> comment.txt
+          cat pr/mypy_primer_diff/mypy_primer.diff >> comment.txt
+          echo '```' >> comment.txt
+
+          echo 'comment<<EOF' >> "$GITHUB_OUTPUT"
+          cat comment.txt >> "$GITHUB_OUTPUT"
+          echo 'EOF' >> "$GITHUB_OUTPUT"
+
+      - name: Find existing comment
+        uses: peter-evans/find-comment@v3
+        if: steps.generate-comment.outcome == 'success'
+        id: find-comment
+        with:
+          issue-number: ${{ steps.pr-number.outputs.pr-number }}
+          comment-author: "github-actions[bot]"
+          body-includes: "<!-- generated-comment mypy_primer -->"
+
+      - name: Create or update comment
+        if: steps.find-comment.outcome == 'success'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          comment-id: ${{ steps.find-comment.outputs.comment-id }}
+          issue-number: ${{ steps.pr-number.outputs.pr-number }}
+          body-path: comment.txt
+          edit-mode: replace