bug: BCOS v2 Engine Scan fails on fork PRs - HttpError 403 when posting PR comment

[Bill0151]

Bug Report: BCOS v2 Engine Scan fails on all fork PRs

Summary

The BCOS v2 Engine Scan workflow fails on every PR submitted from a fork with:

RequestError [HttpError]: Resource not accessible by integration

The BCOS scan itself succeeds (trust score computed, tier met), but the job fails because the "Comment trust score on PR" step attempts to POST a comment to the upstream PR using github.rest.issues.createComment(). GitHub returns HTTP 403 because fork PRs only receive Contents: read, Metadata: read, PullRequests: read permissions. issues=write and pull_requests=write are required to post comments but are not available to the fork's GITHUB_TOKEN.

Evidence

From workflow run on PR #2106:

x-accepted-github-permissions: issues=write; pull_requests=write
HTTP 403 POST https://api.github.com/repos/Scottcjn/Rustchain/issues/2106/comments
"message": "Resource not accessible by integration"

Impact

• All fork PRs show CI failure even when the BCOS scan passes (score was 60/100, L1 tier met)
• Discourages contributors who see CI red when their code is actually fine

Reproduction

Submit any PR from a forked repository. The BCOS v2 Engine Scan job will fail at the "Comment trust score on PR" step regardless of code quality.

Suggested Fix

One of:

1. Add pull-requests: write to the permissions block in .github/workflows/bcos.yml
2. Add a guard: if: github.event.pull_request.head.repo.full_name == github.repository
3. Wrap createComment in a try/catch so the job does not fail when commenting is not permitted

Wallet: bill0151

[github-actions]

Welcome to RustChain! Thanks for opening your first issue.

New here? Check out these resources:

• CONTRIBUTING.md — how to earn RTC bounties
• Good First Issues — easy starter tasks (5-10 RTC)
• Bounty Board — all open bounties

Earn RTC tokens by contributing code, docs, or security fixes. Every merged PR gets paid!

1 RTC = $0.10 USD | pip install clawrtc to start mining

[Scottcjn]

Valid bug. Keeping open.

PR #2136 attempted to fix this but only included tests, not the actual bcos.yml change. The fix is a 1-line if: guard on the comment step. Still needs a PR that modifies .github/workflows/bcos.yml.

Bounty: 25 RTC for a clean fix.