Report failed dispatched Baselines

.github/workflows/dispatch-unverified-agent-heads.yml

@@ -10,6 +10,7 @@ on:
 permissions:
   actions: write
   contents: read
+  issues: write
   pull-requests: read
 
 concurrency:
@@ -34,6 +35,51 @@ jobs:
               workflow_id: "baseline.yml",
             });
 
+            const reportFailure = async (pr, run) => {
+              const marker = `<!-- ross-baseline-run:${run.id} -->`;
+              const comments = await github.paginate(github.rest.issues.listComments, {
+                owner,
+                repo,
+                issue_number: pr.number,
+                per_page: 100,
+              });
+              if (comments.some((comment) => comment.body?.includes(marker))) return;
+
+              const jobs = await github.paginate(
+                github.rest.actions.listJobsForWorkflowRun,
+                {
+                  owner,
+                  repo,
+                  run_id: run.id,
+                  per_page: 100,
+                },
+              );
+              const failures = jobs
+                .filter((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped")
+                .map((job) => {
+                  const steps = (job.steps || [])
+                    .filter((step) => step.conclusion === "failure")
+                    .map((step) => step.name);
+                  return `- **${job.name}** (${job.conclusion})${steps.length ? ` — ${steps.join(", ")}` : ""}`;
+                });
+
+              await github.rest.issues.createComment({
+                owner,
+                repo,
+                issue_number: pr.number,
+                body: [
+                  marker,
+                  `Baseline failed for exact head \`${pr.head.sha}\`.`,
+                  "",
+                  failures.length ? failures.join("\n") : `- Workflow conclusion: **${run.conclusion}**`,
+                  "",
+                  `[Open workflow run](${run.html_url})`,
+                  "",
+                  "Bounded automatic repair runs only for eligible low-risk paths. Protected workflow, dependency, migration, deployment, security, legal, governance, or release changes require focused review.",
+                ].join("\n"),
+              });
+            };
+
             const pullRequests = await github.paginate(github.rest.pulls.list, {
               owner,
               repo,
@@ -67,6 +113,15 @@ jobs:
                 core.info(
                   `PR #${pr.number} already has Baseline run ${exactHeadRun.id} for ${pr.head.sha} (${exactHeadRun.status}/${exactHeadRun.conclusion || "none"}).`,
                 );
+                if (
+                  exactHeadRun.status === "completed" &&
+                  exactHeadRun.conclusion &&
+                  exactHeadRun.conclusion !== "success" &&
+                  exactHeadRun.conclusion !== "skipped" &&
+                  exactHeadRun.conclusion !== "neutral"
+                ) {
+                  await reportFailure(pr, exactHeadRun);
+                }
                 continue;
               }