ci: use pull_request_target to fix token permissions

.github/workflows/verify_data_Integrity.yml

@@ -11,8 +11,6 @@ name: Verify station data integrity
 
 permissions:
   contents: read
-  pull-requests: write
-  issues: write
 
 jobs:
   verify_migration_data:
@@ -30,29 +28,22 @@ jobs:
             echo "result=failure" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Find existing comment
-        if: github.event_name == 'pull_request'
-        uses: peter-evans/find-comment@v3
-        id: find_comment
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-author: "github-actions[bot]"
-          body-includes: "<!-- data-validator -->"
+      - name: Save metadata for comment workflow
+        if: always() && github.event_name == 'pull_request'
+        run: |
+          mkdir -p /tmp/validation-artifacts
+          echo "${{ github.event.pull_request.number }}" > /tmp/validation-artifacts/pr_number
+          echo "${{ steps.validate.outputs.result }}" > /tmp/validation-artifacts/result
+          if [ -f /tmp/validation_report.md ]; then
+            cp /tmp/validation_report.md /tmp/validation-artifacts/
+          fi
 
-      - name: Post or update validation failure comment
-        if: github.event_name == 'pull_request' && steps.validate.outputs.result == 'failure'
-        uses: peter-evans/create-or-update-comment@v4
+      - name: Upload validation artifacts
+        if: always() && github.event_name == 'pull_request'
+        uses: actions/upload-artifact@v4
         with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-id: ${{ steps.find_comment.outputs.comment-id }}
-          body-path: /tmp/validation_report.md
-          edit-mode: replace
-
-      - name: Delete comment if validation passed
-        if: github.event_name == 'pull_request' && steps.validate.outputs.result == 'success' && steps.find_comment.outputs.comment-id != ''
-        run: gh api repos/${{ github.repository }}/issues/comments/${{ steps.find_comment.outputs.comment-id }} -X DELETE
-        env:
-          GH_TOKEN: ${{ github.token }}
+          name: validation-result
+          path: /tmp/validation-artifacts/
 
       - name: Fail job if validation failed
         if: steps.validate.outputs.result == 'failure'

.github/workflows/verify_data_integrity_comment.yml

@@ -0,0 +1,59 @@
+name: Post data validation comment
+
+on:
+  workflow_run:
+    workflows: ["Verify station data integrity"]
+    types: [completed]
+
+permissions:
+  actions: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  comment:
+    name: Post validation result comment
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.event == 'pull_request'
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: validation-result
+          path: /tmp/validation-artifacts
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Read metadata
+        id: meta
+        run: |
+          echo "pr_number=${{ github.event.workflow_run.pull_requests[0].number }}" >> "$GITHUB_OUTPUT"
+          if [ -s /tmp/validation-artifacts/result ]; then
+            echo "result=$(cat /tmp/validation-artifacts/result)" >> "$GITHUB_OUTPUT"
+          else
+            echo "::error::Missing or empty result metadata"
+            exit 1
+          fi
+
+      - name: Find existing comment
+        uses: peter-evans/find-comment@v3
+        id: find_comment
+        with:
+          issue-number: ${{ github.event.workflow_run.pull_requests[0].number }}
+          comment-author: "github-actions[bot]"
+          body-includes: "<!-- data-validator -->"
+
+      - name: Post or update validation failure comment
+        if: steps.meta.outputs.result == 'failure'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ github.event.workflow_run.pull_requests[0].number }}
+          comment-id: ${{ steps.find_comment.outputs.comment-id }}
+          body-path: /tmp/validation-artifacts/validation_report.md
+          edit-mode: replace
+
+      - name: Delete comment if validation passed
+        if: steps.meta.outputs.result == 'success' && steps.find_comment.outputs.comment-id != ''
+        run: gh api repos/${{ github.repository }}/issues/comments/${{ steps.find_comment.outputs.comment-id }} -X DELETE
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/visualize_stopping_patterns.yml

@@ -8,8 +8,6 @@ on:
 
 permissions:
   contents: read
-  pull-requests: write
-  issues: write
 
 jobs:
   visualize:
@@ -34,26 +32,19 @@ jobs:
           BASE_REF="origin/${{ github.event.pull_request.base.ref }}" \
             python3 .github/scripts/visualize_stopping_patterns.py
 
-      - name: Find existing comment
+      - name: Save metadata for comment workflow
         if: always()
-        uses: peter-evans/find-comment@v3
-        id: find_comment
-        with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-author: "github-actions[bot]"
-          body-includes: "<!-- station-visualizer -->"
-
-      - name: Post or update comment
-        if: steps.visualize.outputs.has_changes == 'true'
-        uses: peter-evans/create-or-update-comment@v4
+        run: |
+          mkdir -p /tmp/visualize-artifacts
+          echo "${{ github.event.pull_request.number }}" > /tmp/visualize-artifacts/pr_number
+          echo "${{ steps.visualize.outputs.has_changes }}" > /tmp/visualize-artifacts/has_changes
+          if [ -f /tmp/visualization_comment.md ]; then
+            cp /tmp/visualization_comment.md /tmp/visualize-artifacts/
+          fi
+
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          issue-number: ${{ github.event.pull_request.number }}
-          comment-id: ${{ steps.find_comment.outputs.comment-id }}
-          body-path: /tmp/visualization_comment.md
-          edit-mode: replace
-
-      - name: Delete comment if no changes
-        if: steps.visualize.outputs.has_changes == 'false' && steps.find_comment.outputs.comment-id != ''
-        run: gh api repos/${{ github.repository }}/issues/comments/${{ steps.find_comment.outputs.comment-id }} -X DELETE
-        env:
-          GH_TOKEN: ${{ github.token }}
+          name: visualization-result
+          path: /tmp/visualize-artifacts/

.github/workflows/visualize_stopping_patterns_comment.yml

@@ -0,0 +1,61 @@
+name: Post stopping pattern visualization comment
+
+on:
+  workflow_run:
+    workflows: ["Visualize Stopping Patterns"]
+    types: [completed]
+
+permissions:
+  actions: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  comment:
+    name: Post visualization comment
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'pull_request'
+    steps:
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: visualization-result
+          path: /tmp/visualize-artifacts
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - name: Read metadata
+        id: meta
+        run: |
+          echo "pr_number=${{ github.event.workflow_run.pull_requests[0].number }}" >> "$GITHUB_OUTPUT"
+          if [ -s /tmp/visualize-artifacts/has_changes ]; then
+            echo "has_changes=$(cat /tmp/visualize-artifacts/has_changes)" >> "$GITHUB_OUTPUT"
+          else
+            echo "::warning::has_changes metadata missing or empty, defaulting to false"
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Find existing comment
+        uses: peter-evans/find-comment@v3
+        id: find_comment
+        with:
+          issue-number: ${{ github.event.workflow_run.pull_requests[0].number }}
+          comment-author: "github-actions[bot]"
+          body-includes: "<!-- station-visualizer -->"
+
+      - name: Post or update comment
+        if: steps.meta.outputs.has_changes == 'true'
+        uses: peter-evans/create-or-update-comment@v4
+        with:
+          issue-number: ${{ github.event.workflow_run.pull_requests[0].number }}
+          comment-id: ${{ steps.find_comment.outputs.comment-id }}
+          body-path: /tmp/visualize-artifacts/visualization_comment.md
+          edit-mode: replace
+
+      - name: Delete comment if no changes
+        if: steps.meta.outputs.has_changes == 'false' && steps.find_comment.outputs.comment-id != ''
+        run: gh api repos/${{ github.repository }}/issues/comments/${{ steps.find_comment.outputs.comment-id }} -X DELETE
+        env:
+          GH_TOKEN: ${{ github.token }}