[Infrastructure] O2 linter: Support severity levels and tolerated tests per directory (#10899)

Author: vkucera

.github/workflows/o2-linter.yml

@@ -2,10 +2,10 @@
 # Find issues in O2 code
 name: O2 linter
 
-'on': [pull_request, push]
+"on": [pull_request_target, push]
 permissions: {}
 env:
-  MAIN_BRANCH: master
+  BRANCH_MAIN: master
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
@@ -15,20 +15,47 @@ jobs:
   o2-linter:
     name: O2 linter
     runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
     steps:
+      - name: Set branches
+        run: |
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            branch_head="${{ github.ref }}"
+            branch_base="${{ env.BRANCH_MAIN }}"
+          else
+            branch_head="refs/pull/${{ github.event.pull_request.number }}/merge"
+            branch_base="${{ github.event.pull_request.base.ref }}"
+          fi
+          echo BRANCH_HEAD="$branch_head" >> "$GITHUB_ENV"
+          echo BRANCH_BASE="$branch_base" >> "$GITHUB_ENV"
       - name: Checkout Code
         uses: actions/checkout@v4
         with:
+          ref: ${{ env.BRANCH_HEAD }}
           fetch-depth: 0 # needed to get the full history
       - name: Run tests
+        id: linter
         run: |
-          # Diff against the common ancestor of the source branch and the main branch.
-          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.MAIN_BRANCH }}...)
+          # Diff against the common ancestor of the source (head) branch and the target (base) branch.
+          echo "Diffing ${{ env.BRANCH_HEAD }} against ${{ env.BRANCH_BASE }}."
+          readarray -t files < <(git diff --diff-filter d --name-only origin/${{ env.BRANCH_BASE }}...)
           if [ ${#files[@]} -eq 0 ]; then
               echo "::notice::No files to lint."
+              echo "linter_ran=0" >> "$GITHUB_OUTPUT"
               exit 0
           fi
-          [ ${{ github.event_name }} == 'pull_request' ] && options="-g"
+          echo "linter_ran=1" >> "$GITHUB_OUTPUT"
+          [[ "${{ github.event_name }}" == "pull_request_target" ]] && options="-g"
           # shellcheck disable=SC2086 # Ignore unquoted options.
           python3 Scripts/o2_linter.py $options "${files[@]}"
           echo "Tip: If you allow actions in your fork repository, O2 linter will run when you push commits."
+      - name: Comment PR
+        if: (success() || failure()) && (github.event_name == 'pull_request_target' && steps.linter.outputs.linter_ran == 1)
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          comment-tag: o2-linter
+          message: "**O2 linter results:**
+            ❌ ${{ steps.linter.outputs.n_issues }} errors,
+            ⚠️ ${{ steps.linter.outputs.n_tolerated }} warnings,
+            🔕 ${{ steps.linter.outputs.n_disabled }} disabled"