ci: replace disabled topic-commenter with explore-triage-commenter

[kenyonj]

Summary

Replace the disabled topic-commenter.yml workflow with a new explore-triage-commenter.yml that posts a sticky maintainer-facing comment on PRs touching topic or collection pages.

The original topic-commenter.yml has been disabled (paths gated to ENOSUCHPATH) since [d52a3fd] because it failed on fork PRs — pull_request doesn't grant write tokens to forked-PR runs, so the comment step always failed with a permission error. This PR sidesteps the issue entirely by using pull_request_target and reading PR head content via the API instead of checking out the fork.

What it does

For PRs that touch topics/** or collections/**, the workflow posts a single comment containing:

• Topic PRs — for each topic slug touched: repo count from GET /search/repositories?q=topic:<slug> and a link to the live topic page.
• Collection PRs — for each collection touched: a table of items: entries with star count, last push date, owner type, and a ⚠️ possible self-submission flag when the PR author's login matches an item's owner segment.

The comment is updated in place on subsequent runs (synchronize, reopened) via a <!-- explore-triage-comment --> marker, so the table stays current as a PR evolves rather than stacking new comments.

Example output

A PR adding ollama as a topic plus appending two items to collections/ai-agents/:

## Maintainer triage

### Topics

- **ollama** — 11,932 repositories — [topic page](https://github.com/topics/ollama)

### Collection `ai-agents`

| Item | Stars | Last push | Owner type | Notes |
| --- | ---: | --- | --- | --- |
| [`langchain-ai/langchain`](https://github.com/langchain-ai/langchain) | 135,736 | 2026-05-04 | Organization | – |
| [`huggingface/transformers`](https://github.com/huggingface/transformers) | 160,229 | 2026-05-04 | Organization | – |
| [`kenyonj/zoney`](https://github.com/kenyonj/zoney) | 2 | 2026-03-31 | User | ⚠️ possible self-submission |

Design choices

• pull_request_target + read-only API access. No actions/checkout step. PR commits from forks are mirrored into the base repo's network, so repos.getContent({ref: pr.head.sha}) works against the base repo. This keeps the workflow simple and avoids the fork-checkout class of issues addressed in Fix lint workflow failing on fork PRs #5094.
• Permissions are minimal: contents: read, pull-requests: write. No write access to repository contents.
• Untrusted-input hygiene. Slugs and item strings parsed from PR-supplied content are regex-validated (^[a-z0-9](?:[a-z0-9-]{0,80}[a-z0-9])?$ for slugs, ^[\w.-]+/[\w.-]+$ for items) before being passed to any API call. Content read from PR head is treated as data, never executed or interpolated into shell or paths.
• Inline YAML frontmatter parser. Avoids an npm install js-yaml step. The format is highly consistent across all 101 collections; a regex-based extractor of the items: block is sufficient and self-contained.
• Search API rate limit is 30 req/min for authenticated requests; even a 12-topic PR like Game engines websites #5126 stays well under.

Testing

Tested in kenyonj/explore with the workflow on main and pull_request_target enabled:

PR	Shape	Outcome
#3	Topic add (no organic repos)	Comment with 0 repositories ✓
#6	Topic add (ollama, ~12k repos)	Comment with 11,932 repositories ✓
#4	Collection add — 2 items including a self-submission	Table renders, ⚠️ possible self-submission correctly flagged on kenyonj/zoney. After a synchronize push, comment updated in place (same comment id, no duplicate) ✓
#5	README tweak (negative case)	No workflow run dispatched (path filter excludes) ✓

Intentionally not in v1

• Diff against base for collection edits. Currently the table lists every item in the collection on edits, not just the ones the PR adds. Cleaner output is a follow-up — happy to take it in a v2 once we see how the comment reads in practice.
• Rename detection for topic PRs (status === 'renamed' / previous_filename).
• Frontmatter diff for topic edits (which fields changed).
• Star threshold logic. The comment surfaces the raw number; threshold decisions stay with maintainers.

Drops

• .github/workflows/topic-commenter.yml — disabled since [d52a3fd], superseded by this workflow.

[Copilot]

Pull request overview

Replaces the previously-disabled topic-commenter.yml workflow with a new explore-triage-commenter.yml workflow that posts (and updates in place) a maintainer-facing triage comment on PRs that modify topics/** or collections/**, using pull_request_target and GitHub API reads instead of checking out fork content.

Changes:

• Delete the disabled topic-commenter.yml workflow.
• Add explore-triage-commenter.yml to generate a sticky triage comment summarizing touched topics (repo counts) and collections (repo metadata table).

Show a summary per file

File	Description
.github/workflows/topic-commenter.yml	Removes the legacy workflow that was path-gated and effectively disabled.
.github/workflows/explore-triage-commenter.yml	Adds a pull_request_target workflow to post/update a sticky maintainer triage comment for topic/collection PRs.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 3

[ahpook]

Nice, this looks great!

[ahpook]

🚀