fix: workflow permissions and relevance-check bypass regressions

.github/actions/complete-pr-comment/action.yaml

@@ -1,7 +1,8 @@
 name: "Complete PR Comment"
-description:
-  "Removes the 'eyes' reaction and adds a completion reaction ('rocket' for success, 'confused' for 'failure', 'cancelled', or 'skipped') to the
-  triggering comment."
+description: >-
+  Removes the 'eyes' reaction and adds a completion reaction ('rocket' for success, 'confused' for 'failure',
+  'cancelled', or 'skipped') to the triggering comment. Requires `issues: write` permission in the calling
+  workflow to update comment reactions via the GitHub Reactions API.
 inputs:
   status:
     description:

.github/actions/workflow-setup/action.yaml

@@ -29,6 +29,9 @@ inputs:
   exclude-globs:
     description: "Exclude globs for change detection"
     required: false
+  head-ref:
+    description: "Explicit head ref for change detection (overrides the resolved ref)"
+    required: false
 
 outputs:
   is_act:
@@ -119,3 +122,4 @@ runs:
         file-type: ${{ inputs.file-type }}
         include-globs: ${{ inputs.include-globs }}
         exclude-globs: ${{ inputs.exclude-globs }}
+        head-ref: ${{ inputs.head-ref }}

.github/workflows/actionlint-check.yaml

@@ -62,11 +62,16 @@ jobs:
             .github/workflows/**/*.yaml
             .github/actions/**/*.yml
             .github/actions/**/*.yaml
+          head-ref: ${{ inputs.pr-head-sha }}
 
   actionlint-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/clang-format-check.yaml

@@ -35,7 +35,7 @@ jobs:
   clang-format-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (github.event_name == 'workflow_dispatch' || needs.setup.outputs.has_changes == 'true')
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/clang-format-fix.yaml

@@ -52,6 +52,7 @@ run-name: "${{ github.actor }} fixing C++ code format"
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup:

.github/workflows/clang-tidy-check.yaml

@@ -47,7 +47,7 @@ jobs:
   clang-tidy-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (github.event_name == 'workflow_dispatch' || needs.setup.outputs.has_changes == 'true')
     runs-on: ubuntu-24.04
     container:
       image: ghcr.io/framework-r-d/phlex-ci:latest

.github/workflows/cmake-build.yaml

@@ -102,6 +102,7 @@ jobs:
           pr-base-sha: ${{ inputs.pr-base-sha }}
           checkout-path: ${{ inputs.checkout-path }}
           build-path: ${{ inputs.build-path }}
+          head-ref: ${{ inputs.pr-head-sha }}
           file-type: |
             cpp
             cmake
@@ -123,7 +124,11 @@ jobs:
   build:
     needs: [setup, generate-matrix]
     if: >
-      always() && needs.setup.result == 'success' && needs.setup.outputs.has_changes == 'true'
+      always() && needs.setup.result == 'success' && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: false

.github/workflows/cmake-format-check.yaml

@@ -58,11 +58,16 @@ jobs:
         uses: Framework-R-D/phlex/.github/actions/workflow-setup@main
         with:
           file-type: cmake
+          head-ref: ${{ inputs.pr-head-sha }}
 
   cmake-format-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

.github/workflows/cmake-format-fix.yaml

@@ -52,6 +52,7 @@ run-name: "${{ github.actor }} fixing CMake format"
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup:

.github/workflows/coverage.yaml

@@ -63,7 +63,7 @@ jobs:
   coverage:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (github.event_name == 'workflow_dispatch' || needs.setup.outputs.has_changes == 'true')
     runs-on: ubuntu-24.04
     container:
       image: ghcr.io/framework-r-d/phlex-ci:latest

.github/workflows/header-guards-check.yaml

@@ -58,11 +58,16 @@ jobs:
         uses: Framework-R-D/phlex/.github/actions/workflow-setup@main
         with:
           file-type: cpp
+          head-ref: ${{ inputs.pr-head-sha }}
 
   header-guards-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/header-guards-fix.yaml

@@ -52,6 +52,7 @@ run-name: "${{ github.actor }} fixing header guards"
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup:

.github/workflows/jsonnet-format-check.yaml

@@ -58,11 +58,16 @@ jobs:
         uses: Framework-R-D/phlex/.github/actions/workflow-setup@main
         with:
           file-type: jsonnet
+          head-ref: ${{ inputs.pr-head-sha }}
 
   jsonnet-format-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-latest
     container:
       image: public.ecr.aws/bitnami/jsonnet:latest

.github/workflows/jsonnet-format-fix.yaml

@@ -52,6 +52,7 @@ run-name: "${{ github.actor }} fixing Jsonnet format"
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup:

.github/workflows/markdown-check.yaml

@@ -58,11 +58,16 @@ jobs:
         uses: Framework-R-D/phlex/.github/actions/workflow-setup@main
         with:
           file-type: md
+          head-ref: ${{ inputs.pr-head-sha }}
 
   markdown-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/markdown-fix.yaml

@@ -52,6 +52,7 @@ run-name: "${{ github.actor }} fixing Markdown format"
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup:

.github/workflows/python-check.yaml

@@ -58,11 +58,16 @@ jobs:
         uses: Framework-R-D/phlex/.github/actions/workflow-setup@main
         with:
           file-type: python
+          head-ref: ${{ inputs.pr-head-sha }}
 
   python-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (
+        github.event_name == 'workflow_dispatch' ||
+        inputs.skip-relevance-check ||
+        needs.setup.outputs.has_changes == 'true'
+      )
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/python-fix.yaml

@@ -52,6 +52,7 @@ run-name: "${{ github.actor }} fixing Python code"
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup:

.github/workflows/yaml-check.yaml

@@ -34,7 +34,7 @@ jobs:
   yaml-check:
     needs: setup
     if: >
-      always() && needs.setup.outputs.has_changes == 'true'
+      always() && (github.event_name == 'workflow_dispatch' || needs.setup.outputs.has_changes == 'true')
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

.github/workflows/yaml-fix.yaml

@@ -52,6 +52,7 @@ name: YAML Fix
 permissions:
   pull-requests: write
   contents: write
+  issues: write
 
 jobs:
   setup: