github-ci: consolidate new authors check into a single workflow

Replace the two-workflow pattern (authors.yml + authors-done.yml) with a
single pull_request_target workflow.

I'm not sure this was possible when this job was originally created, but
apparently it is now.

.github/workflows/authors-done.yml

@@ -1,53 +0,0 @@
-name: New Authors Report
-
-on:
-  workflow_run:
-    workflows: [New Authors Check]
-    types: [completed]
-
-jobs:
-  comment:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "Author check is complete"
-
-      - name: Download artifact new authors
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
-        with:
-          script: |
-            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
-               owner: context.repo.owner,
-               repo: context.repo.repo,
-               run_id: context.payload.workflow_run.id,
-            });
-            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
-              return artifact.name == "new-authors";
-            })[0];
-            let download = await github.rest.actions.downloadArtifact({
-               owner: context.repo.owner,
-               repo: context.repo.repo,
-               artifact_id: matchArtifact.id,
-               archive_format: 'zip',
-            });
-            let fs = require('fs');
-            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/new-authors.zip`, Buffer.from(download.data));
-      - run: unzip new-authors.zip
-      - run: |
-          if test -s new-authors.txt; then
-            echo new_authors=yes >> $GITHUB_ENV
-          fi
-      - name: Comment on PR
-        if: ${{ env.new_authors == 'yes' }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            let fs = require('fs');
-            let issue_number = Number(fs.readFileSync('./pr-number.txt'));
-            let msg = 'NOTE: This PR may contain new authors.';
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: issue_number,
-              body: msg
-            });

.github/workflows/authors.yml

@@ -1,12 +1,19 @@
 name: New Authors Check
 
+# pull_request_target runs with base-repo permissions (including write) even
+# for fork PRs, allowing us to post a comment directly without the artifact
+# hand-off to a second workflow_run workflow.
+#
+# Only git history is read here — no PR code is built or executed — so
+# checking out the PR head SHA is safe under pull_request_target.
 on:
-  pull_request:
+  pull_request_target:
 
-permissions: read-all
+permissions:
+  pull-requests: write
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
 jobs:
@@ -36,13 +43,17 @@ jobs:
                  echo has_new_authors="yes" >> $GITHUB_ENV
              fi
           done < commit-authors.txt
-      - run: mkdir new-authors
-      - run: cp new-authors.txt new-authors
-      - run: echo ${{ github.event.number }} > new-authors/pr-number.txt
-      - run: ls -l
-      - name: Upload new authors
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+      - name: Comment on PR
+        if: ${{ env.has_new_authors == 'yes' }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
         with:
-          name: new-authors
-          path: new-authors
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            let msg = 'NOTE: This PR may contain new authors.';
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: msg
+            });