fix: resolve fork PRs in bumpy ci comment

[theoephraim]

Problem

bumpy ci comment under workflow_run resolved the target PR via GET repos/{repo}/commits/{head_sha}/pulls. That endpoint only returns PRs whose head commit lives in the base repo's own branches. For a PR opened from a fork the head commit isn't there, so it returned [] and the command exited 1 with "Could not resolve a target PR". Same-repo PRs already worked before the 1.18 fork-safe split; fork PRs are exactly what the split exists for.

Example: https://github.com/dmno-dev/varlock/actions/runs/34675271163 (fork PR dmno-dev/varlock#1075).

Fix

Keep the commits-endpoint lookup as the first attempt; when it's empty, fall back to:

gh api --paginate "repos/{repo}/pulls?state=open&per_page=100" --jq '.[] | select(.head.sha == "<head_sha>") | .number'

--paginate covers repos with >100 open PRs. The target still derives only from the trusted workflow_run.head_sha — never from the artifact, and never from workflow_run.pull_requests[] (which GitHub leaves empty for forks).

Tests

• fork case: commits endpoint returns nothing → open-PR scan finds the match (asserts --paginate and the head.sha filter)
• same-repo case: commits endpoint answers → no scan
• neither finds anything → null

Patch bump file included; varlock pins ^1.18.1 and should update once released.

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/bumpy 1.18.1 → 1.18.2

Bump files in this PR

• ci-comment-fork-pr-resolution.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[pullfrog]

✅ No new issues found.

Reviewed changes in the fork PR resolution path, its regression coverage, and the release note.

• Fork fallback — Keeps the commit association lookup as the fast path, then paginates open pull requests and matches the trusted workflow_run.head_sha against head.sha.
• Trust boundary — Continues deriving the comment target exclusively from the validated GitHub event SHA rather than artifact-controlled data.
• Regression coverage — Exercises same-repository resolution, fork fallback including pagination and SHA filtering, and the no-match case; focused tests, type checking, and formatting checks pass.
• Release metadata — Adds a patch bump entry describing the corrected fork behavior.

  ^{｜ View workflow run ｜ Using azure/gpt-5.6-sol ｜ 𝕏}