fix(CI): Fix CI pipeline for wallet-core fork pull requests

[sergei-boiko-trustwallet]

This pull request refactors the "BC risk router" workflow to improve security, reliability, and maintainability by splitting the process into two separate GitHub Actions workflows: bc-scanner and bc-risk-router. The scanner workflow runs in the unprivileged fork context to detect sensitive file changes and uploads the result as an artifact, while the router workflow runs in the base repository context to post comments and enforce gating based on the scan results. The PR also improves the logic for associating PRs with workflow runs, enhances check run posting, and clarifies environment variable usage in comments.

Workflow separation and security model:

• Introduced a new bc-scanner workflow (.github/workflows/claude-bc-scanner.yml) that runs on PR events in the fork context (no secrets, read-only), detects changes to persistence-sensitive files, and uploads the results as an artifact for downstream consumption.
• Refactored bc-risk-router (.github/workflows/claude-bc-risk-router.yml) to run on workflow_run events triggered by the scanner, ensuring it only runs with write permissions in the base repo context and never checks out code.

Improved artifact handling and comment logic:

• The router workflow now downloads the scan artifact, reads changed files and PR metadata from it, and posts a reminder comment only if relevant files were changed, ensuring accurate gating.
• Updated the logic for posting and verifying reminder comments to reference the correct PR number and use environment variables safely in comment templates. [1] [2]

Enhanced check run and PR association:

• Improved the method for associating workflow runs with PRs, including robust fallback logic for fork PRs, and introduced a helper to post check runs directly to the correct commit SHA regardless of trigger event.
• The verify job now posts detailed check runs with success or failure status, clear summaries, and actionable messages based on audit and sign-off status.

These changes collectively make the BC risk gating process more secure, reliable, and maintainable by clearly separating concerns, minimizing permission scopes, and ensuring that gating logic accurately tracks the state of each PR.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR updates the bc-risk-router GitHub Actions workflow to run on pull_request_target instead of pull_request, and adjusts checkout behavior to scan PR head changes.

Changes:

• Switch workflow trigger from pull_request to pull_request_target.
• Update job condition to match the new event name.
• Checkout the PR head SHA to compute diffs against the contributor’s changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Binary size comparison

➡️ aarch64-apple-ios: 14.31 MB

➡️ aarch64-apple-ios-sim: 14.32 MB

➡️ aarch64-linux-android: 18.73 MB

➡️ armv7-linux-androideabi: 16.17 MB

➡️ wasm32-unknown-emscripten: 13.66 MB

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.