fix: inherit permissions instead

The PR caller doesnt allow package write, the builder requested it always. Inherit it from caller instead -> Write on push and no write on PR

Also fix a potential race conditions when fast, consecutive pushes can result in a invalid comment state.

.github/workflows/build_firmware.yml

@@ -15,10 +15,7 @@ on:
 jobs:
   build_fw_builder:
     name: Build fw-builder Docker image
-    runs-on: ubuntu-latest
-    permissions:
-      packages: write
-      contents: read
+    runs-on: ubuntu-latest # Inherits permissions from caller
     outputs:
       image_ref: ${{ steps.published-image.outputs.image_ref || steps.local-image.outputs.image_ref }}
     steps:

.github/workflows/on_pr_comment.yml

@@ -38,6 +38,17 @@ jobs:
               return;
             }
 
+            const { data: pull } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: pullNumber,
+            });
+
+            if (pull.head.sha !== run.head_sha) {
+              core.notice(`Skipping superseded workflow run ${run.id}`);
+              return;
+            }
+
             const marker = '<!-- chameleon-ultra-pr-build-artifacts -->';
             const lines = [marker, `# Build result for commit ${run.head_sha}`, ''];