ci: comment review-binary download link on PRs, add Windows build

[DTTerastar]

Problem

CI has cross-compiled review binaries for every PR since v1.2.0, but nothing ever linked to them — you had to know they existed and go dig through the Actions run page. So "try this before we merge it" was harder than it needed to be, especially for a drive-by contributor or an issue reporter who just wants to confirm their bug is gone.

Change

A workflow_run workflow posts a sticky comment with the download link once CI succeeds on a PR:

Try this PR without building it

CI cross-compiled review binaries for commit abc1234:

Download from the run page — the liftoff-export artifact holds all platforms.

Platform	File
macOS (Apple silicon)	liftoff-export-darwin-arm64
…	…

Also adds windows/amd64 to the cross-compile matrix. Goreleaser has always shipped a Windows binary for tagged releases, but CI built darwin and linux only — so Windows users had nothing to test with. The reporter of #55 is on Windows, which is what surfaced this.

Why workflow_run instead of a step in CI

Contributor PRs come from forks (#52, #53, #54 all did), and fork PRs get a read-only GITHUB_TOKEN — a comment step inside the CI job physically cannot post. workflow_run runs in the base-repo context where the token is writable.

The usual hazard with that pattern is handing a writable token to untrusted code. This job avoids it structurally: it has no actions/checkout, builds nothing, and runs nothing from the PR. It reads run metadata and posts a comment, full stop. The binaries are still built in the ordinary pull_request job with a read-only token.

workflow_run.pull_requests is empty for fork PRs, so the PR number is resolved from the head SHA via the commits API.

Verification

• Both workflow files parse as valid YAML.
• The windows/amd64 build works: file reports PE32+ executable (console) x86-64, for MS Windows.
• Dry-ran the comment body generation locally — heredoc de-indentation and the ${HEAD_SHA:0:7} truncation both render correctly.

This PR cannot demonstrate itself. workflow_run workflows only fire when present on the default branch, so no comment will appear here — it starts working on the next PR after this merges. Worth knowing before you look for a bot comment that isn't coming.

Caveats

• Downloading Actions artifacts requires being signed in to GitHub. Anonymous users can't, and there's no fix for that short of publishing binaries somewhere else.
• Artifacts expire after 14 days (existing retention-days setting, unchanged).
• The comment fires only on CI success. A failing PR gets no comment rather than a link to a broken build.

🤖 Generated with Claude Code

https://claude.ai/code/session_013JJnPtEtP97to9Rv2QMoer