pr writer fixes

.github/workflows/pr-formatting-check.yml

@@ -6,10 +6,13 @@ on:
       - opened
       - reopened
       - edited
+      - synchronize
 
 permissions:
+  contents: read
   statuses: write
   pull-requests: write
+  issues: write
 
 jobs:
   title-check:
@@ -25,11 +28,11 @@ jobs:
         id: title_check
         uses: amannn/action-semantic-pull-request@v6
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Comment with changelog hint on failure
         if: failure()
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const marker = '<!-- pr-title-check -->';
@@ -46,8 +49,11 @@ If this change should appear in release notes, ensure the title reflects the cor
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.issue.number,
+              per_page: 100,
             });
-            const existing = comments.find((comment) => comment.body && comment.body.includes(marker));
+
+            const existing = comments.find((comment) => (comment.body || "").includes(marker));
+
             if (existing) {
               await github.rest.issues.updateComment({
                 owner: context.repo.owner,
@@ -63,3 +69,31 @@ If this change should appear in release notes, ensure the title reflects the cor
                 body,
               });
             }
+
+      - name: Remove failure comment on success
+        if: success()
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const marker = '<!-- pr-title-check -->';
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              per_page: 100,
+            });
+
+            const existing = comments.find((comment) => (comment.body || "").includes(marker));
+            if (!existing) {
+              core.info("No previous PR title failure comment found.");
+              return;
+            }
+
+            await github.rest.issues.deleteComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: existing.id,
+            });
+
+            core.info(`Deleted previous failure comment id=${existing.id}`);

.github/workflows/pr-writer.yml

@@ -1,4 +1,23 @@
-comment_firmware:
+name: PR writes (label + comment)
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      # Safe: labeler reads files from the base repo by default in pull_request_target context.
+      # Do NOT checkout PR head.
+      - uses: actions/labeler@v5
+
+    comment_firmware:
     runs-on: ubuntu-latest
     steps:
         - name: Find the matching CI run for this PR SHA