revert(ci): remove sticky build-matrix PR comment breaking restricted callers (2.4.1)

.github/workflows/csharp-ci.yaml

@@ -483,39 +483,6 @@ jobs:
           status="$(.github-actions-helpers/scripts/aggregate_matrix_status.py ci-results)"
           echo "matrix-status=$status" >> "$GITHUB_OUTPUT"
 
-  matrix-comment:
-    name: matrix-comment (${{ inputs.artifact-prefix }})
-    needs: build-and-test
-    if: ${{ !cancelled() && inputs.build-matrix != '' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout CI helpers
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: peacefulstudio/github-actions
-          ref: ${{ job.workflow_sha }}
-          path: .github-actions-helpers
-      - name: Render build-matrix table
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SELF_JOB_NAME: matrix-comment (${{ inputs.artifact-prefix }})
-          MATRIX_TITLE: 'C# build matrix'
-        run: |
-          set -euo pipefail
-          gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/jobs" \
-            | .github-actions-helpers/scripts/render_matrix_comment.py "$SELF_JOB_NAME" "$MATRIX_TITLE" \
-            > build-matrix-results.md
-      - name: Add build-matrix PR comment
-        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
-        with:
-          recreate: true
-          header: ${{ inputs.artifact-prefix }}-build-matrix
-          path: build-matrix-results.md
-
   pack:
     name: pack
     if: ${{ inputs.pack }}

.github/workflows/scala-ci.yaml

@@ -412,36 +412,3 @@ jobs:
           set -euo pipefail
           status="$(.github-actions-helpers/scripts/aggregate_matrix_status.py ci-results)"
           echo "matrix-status=$status" >> "$GITHUB_OUTPUT"
-
-  matrix-comment:
-    name: matrix-comment (${{ inputs.artifact-prefix }})
-    needs: build-and-test
-    if: ${{ !cancelled() && inputs.build-matrix != '' && github.event_name == 'pull_request' && github.actor != 'dependabot[bot]' }}
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      pull-requests: write
-    steps:
-      - name: Checkout CI helpers
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          repository: peacefulstudio/github-actions
-          ref: ${{ job.workflow_sha }}
-          path: .github-actions-helpers
-      - name: Render build-matrix table
-        env:
-          GH_TOKEN: ${{ github.token }}
-          SELF_JOB_NAME: matrix-comment (${{ inputs.artifact-prefix }})
-          MATRIX_TITLE: 'Scala build matrix'
-        run: |
-          set -euo pipefail
-          gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/jobs" \
-            | .github-actions-helpers/scripts/render_matrix_comment.py "$SELF_JOB_NAME" "$MATRIX_TITLE" \
-            > build-matrix-results.md
-      - name: Add build-matrix PR comment
-        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
-        with:
-          recreate: true
-          header: ${{ inputs.artifact-prefix }}-build-matrix
-          path: build-matrix-results.md

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.1] - 2026-07-16
+
+### Removed
+
+- Revert 2.4.0's sticky build-matrix PR comment from `csharp-ci.yaml` and `scala-ci.yaml`. The `matrix-comment` job requests `actions: read`, and a called workflow cannot request a permission its caller's `permissions:` block does not grant — GitHub rejects the caller run at startup (`startup_failure`, before any job runs, on every event type; the job-level `if` guards cannot help because the check is static). Every caller with a restricted top-level `permissions:` block was unable to run CI at all from the moment the floating `v2` tag moved to 2.4.0. Callers that had granted `actions: read` lose only the comment; coverage comments and all other outputs are unchanged. The feature will return reading the existing per-shard `ci-results` artifacts instead of the jobs API, which needs no extra caller permissions. (#37)
+
 ## [2.4.0] - 2026-07-14
 
 ### Added
@@ -140,7 +146,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   - `csharp-ci.yaml` — .NET build / test / coverage / pack.
   - `terraform-ci.yaml` — Terraform fmt / validate / test.
 
-[Unreleased]: https://github.com/peacefulstudio/github-actions/compare/v2.4.0...HEAD
+[Unreleased]: https://github.com/peacefulstudio/github-actions/compare/v2.4.1...HEAD
+[2.4.1]: https://github.com/peacefulstudio/github-actions/compare/v2.4.0...v2.4.1
 [2.4.0]: https://github.com/peacefulstudio/github-actions/compare/v2.3.4...v2.4.0
 [2.3.4]: https://github.com/peacefulstudio/github-actions/compare/v2.3.3...v2.3.4
 [2.3.3]: https://github.com/peacefulstudio/github-actions/compare/v2.3.2...v2.3.3