mypy_primer comment timeout

[Akuli]

Sometimes mypy_primer comment CI job times out. It seems to happen only when adding multiple commits to the pull request before mypy_primer finishes. See #5365 for an example.

[Akuli]

Timestamps in #5392:

1. Mon, 10 May 2021 09:43:20 GMT comment job starts
2. Mon, 10 May 2021 10:13:45 GMT comment job timeout
3. Mon, 10 May 2021 10:47:02 GMT run(1) starts
4. Mon, 10 May 2021 11:07:06 GMT run(1) uploads diff

The comment job starts way too early, perhaps because a maintainer has to approve the CI run, but somehow the comment job starts anyway. What confuses me the most is how this can also happen for not-first-time contributors. Here are timestamps from #5365:

1. Fri, 07 May 2021 12:41:40 GMT comment job starts
2. Fri, 07 May 2021 13:07:44 GMT run(1) starts
3. Fri, 07 May 2021 13:11:58 GMT comment job times out
4. Fri, 07 May 2021 13:27:09 GMT run(1) uploads diff

[JelleZijlstra]

I noticed on some PRs that I had to click the button to approve runs many times for a single PR. Not sure how that logic works.

[srittau]

I think you have to approve the run for each push in the first PR of a contributor. I guess that's a bug, but who knows.

[Akuli]

A possible fix would be to add needs: mypy_primer to the comment job. But then it would need to be in the same file with running mypy_primer, so mypy_primer running would get an unnecessary pull-requests: write permission. @hauntsaninja Is that why this wasn't done that way in the first place?

[JelleZijlstra]

I believe that would cause a security issue because user code would be able to influence a job with the write permission.

[hauntsaninja]

Yeah, that's why they're separate workflows. Without the newly added by Github permissions field, I think the write permission wasn't even scoped. Maybe it's now possible to set more granular permissions so that only the commenting part can write? https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idpermissions

[hauntsaninja]

#5428 resolves