ci: a failing drift run reports to the issue tracker, not the Actions tab

The job as first written had the flaw it was built to fix, one level up: it
would detect upstream breakage and then tell nobody. A scheduled run has no
pull request to turn red and no author to notify, and this repository has
already paid for exactly that -- `pages.yml` failed on two consecutive
pushes and sat unnoticed for the better part of two months, while the
published site served a version six releases behind. A weekly job in a
repository that goes quiet for weeks is the same shape.

So a failure now opens an issue, or comments on the open one if there is
already one. Reused rather than re-opened: an unattended weekly job that
files a fresh issue every Monday is a second way of being ignored. Matched
on title rather than a label, so it needs no label to exist first.

The body says what a reader needs and not more: that this is not any
branch's fault, that every other job resolves against `uv.lock` while this
one does not, that the remedy is an upstream fix or a narrower range in
pyproject.toml (#103), and that the run log's lockfile diff names what
moved.

`issues: write` is added at the job level, which replaces rather than
extends the workflow's permissions, so `contents: read` is repeated there.

Verified by extracting the step's script from the parsed YAML and running it
against a stubbed `gh`: the heredoc dedents correctly out of the block
scalar, the escaped backticks survive as literals, `$RUN_URL` expands, and
the two paths do what they claim -- create when no issue is open, comment
when one is, with no duplicate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Shashankss1205

.github/workflows/ci.yml

@@ -190,6 +190,12 @@ jobs:
     name: upstream drift (unlocked deps)
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-latest
+    # `issues: write` is for the reporting step below; a job's permissions
+    # replace the workflow's rather than adding to them, so `contents: read`
+    # is repeated here.
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@v4
       - uses: astral-sh/setup-uv@v5
@@ -207,6 +213,45 @@ jobs:
         run: |
           uv sync --all-extras --group dev
           uv run pytest
+      - name: Say so where someone will see it
+        # A scheduled run reports to nobody. This repository has already paid
+        # for that: `pages.yml` failed on two consecutive pushes and the
+        # failures sat unnoticed for the better part of two months, while the
+        # published site served a version six releases behind. A weekly job in
+        # a repository that goes quiet for weeks at a time is the same shape,
+        # so the failure comes to the issue tracker instead of the Actions tab.
+        #
+        # One issue, reused: an unattended weekly job that opens a fresh issue
+        # every Monday is a second way of being ignored. Matched on title
+        # rather than a label, so this needs no label to exist first.
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TITLE: "upstream drift: the suite fails against re-resolved dependencies"
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          body=$(cat <<EOF
+          The weekly \`upstream-drift\` job failed: the suite does not pass against the
+          newest dependency versions \`pyproject.toml\` allows.
+
+          Run: $RUN_URL
+
+          **This is not a failure of any branch.** Every other job resolves against
+          \`uv.lock\`; this one re-resolves from scratch. So either an upstream release
+          broke something, or a range in \`pyproject.toml\` needs narrowing — which is
+          what #103 asks for. The job prints the re-resolved lockfile diff, so the run
+          log says which dependencies moved.
+          EOF
+          )
+          existing=$(gh issue list --state open --search "$TITLE in:title" \
+            --json number --jq '.[0].number // empty')
+          if [ -n "$existing" ]; then
+            echo "commenting on existing issue #$existing"
+            gh issue comment "$existing" --body "$body"
+          else
+            echo "opening a new issue"
+            gh issue create --title "$TITLE" --body "$body"
+          fi
 
   build:
     name: build and check the distribution