[CI] Add the pull request explainer on a GitHub-hosted runner

This pull request adds one workflow file to the artifacts repository. When someone opens a pull request, Claude Code reads it first and decides whether a person who didn't write it would want it walked through. The workflow is a single new file, forty-seven lines, and nothing else changes.

A new pull request starts a run. Claude Code reads the pull request and decides whether someone who didn't write it would want it walked through. If yes, the run posts a watch link on the pull request. The rest get no comment, and the reason goes in the run's log.

Three pull request events start a run automatically: opened, ready for review, and reopened. You can also start it by hand with a pull request number. That's how an already merged pull request, number one here, gets explained. Manual runs always explain, because the action ignores the judging setting outside pull request events.

The job has one step, and it runs on a free GitHub-hosted Ubuntu runner. It calls the presenter action at version one, the same setup the presenter repository runs on itself. The setting that matters is when: judged, which lets Claude Code decide. It signs in with a Claude Code token stored as a repository secret.

- uses: bisque-cloud/presenter@v1
with:
source: pull-request
pull-request: ${{ inputs.pull-request }}
when: judged
claude-code-oauth-token:
${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

A condition on the job filters automatic runs before any Claude Code time is spent. Draft pull requests are skipped, and the ready for review event picks them up once they're ready. Pull requests from forks are left out because GitHub gives those runs no secrets. Dependabot pull requests are skipped too. A manual run passes every one of these checks.

The token gets the least it needs. It reads contents, writes to pull requests so it can post the watch link, and requests an ID token so the run can sign in with GitHub to publish. A concurrency group keyed on the pull request number keeps runs for the same pull request from overlapping.

The author lists one risk. Every Copybara sync pull request gets judged too, which means one Claude Code run for each opened pull request. Those runs count against the Claude plan, and the author expects most of them to end in a skip. The workflow itself is safe from the mirror. The .github folder exists only in this repository, so syncs never overwrite it.

There is no test evidence yet, and the pull request says so: it's not yet run. It needs a repository secret called CLAUDE CODE OAUTH TOKEN, which the author creates with claude setup-token. Until that secret is set, this pull request's own run fails at the missing token.

To review this, check the conditions and permissions in the file, then set the secret. A manual run on the merged pull request number one then exercises the whole path from signing in to the watch link. What stays unknown until real traffic arrives is how often Claude Code skips the Copybara syncs, which decides what this costs on the Claude plan.