Link a semantic diff page on each pull request

When a pull request is opened, reopened or pushed, the Semantic Diff
workflow renders its commits with scripts/commitRecords.js, uploads the page
to the CDN at semantic-diff/pr-<N>/index.html, and keeps one comment on the
pull request with its link. The link carries the rendered head commit as a
query string. Closing the pull request deletes the page. A pull request
from a branch of this repository runs on pull_request, with its own
workflow and renderer, from its first push and on any base branch. A pull
request from a fork runs on pull_request_target.

Security: pull_request_target takes the workflow from the default branch
and runs it with the repository's secrets, so for forks the job runs only
the default branch's code. It checks out the base commit without persisted
credentials, fetches refs/pull/<N>/head as git objects, and renders them
with the base branch's renderer, which reads git data and escapes all text
it writes into the page. Each pull request runs on one of the two events:
the jobs compare the event with the head repository, and the concurrency
group names the event.

Review: Why the CDN and not GitHub Pages? Pages here is one deployment from
    master (the dev playground) that each deploy replaces whole; the CDN
    already holds the playground's per-pull-request bundles under
    dev-playground-bundles/pr-<N>/.

Area: ci docs
Changelog: none
Output: unchanged
Ran: Semantic Diff run on #8870 (render ok; upload needs
 --s3-no-check-bucket, as the playground upload uses); dry run of the render step in a fresh blob:none clone of
 rescript-lang/rescript against refs/pull/8862/head (page written, both
 checks pass); YAML parse (ok, both triggers and job
 conditions read back); upload, comment and cleanup steps run only on
 GitHub
PR: #8870
Signed-off-by: Cristiano Calcagno <cristianoc@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: cristianoc

.claude/skills/records/SKILL.md

@@ -133,3 +133,6 @@ node scripts/commitRecords.js --fragment --out part.html <rev>...
   the description of the work. A pull request description is a rendering of
   its range.
 - Before review or merge: render `master..<branch>` and hand over the page.
+- On GitHub, `.github/workflows/semantic_diff.yml` renders each pull
+  request's range when it is opened or pushed, and comments the page's link
+  (`Semantic diff: https://cdn.rescript-lang.org/semantic-diff/pr-<N>/…`).

.github/workflows/semantic_diff.yml

@@ -0,0 +1,104 @@
+name: Semantic Diff
+
+# Renders the commit records of each pull request (scripts/commitRecords.js)
+# as a review page on the CDN and links it from the pull request.
+#
+# A pull request from a branch of this repository runs on pull_request, with
+# its own workflow and renderer. A pull request from a fork runs on
+# pull_request_target, which GitHub takes from the default branch and runs
+# with the repository's secrets: it executes only the default branch's code,
+# and the fork's commits are fetched as git data and never checked out.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, closed]
+  pull_request_target:
+    types: [opened, synchronize, reopened, closed]
+
+concurrency:
+  group: semantic-diff-${{ github.event_name }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  render:
+    if: >-
+      github.event.action != 'closed' &&
+      github.actor != 'dependabot[bot]' &&
+      (github.event_name == 'pull_request') ==
+      (github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
+    env:
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+      BASE_SHA: ${{ github.event.pull_request.base.sha }}
+    steps:
+      - name: Checkout renderer
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.pull_request.base.sha }}
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+
+      - name: Render semantic diff
+        id: render
+        run: |
+          git fetch --no-tags --filter=blob:none origin "refs/pull/${PR_NUMBER}/head:refs/heads/pr-${PR_NUMBER}"
+          base=$(git merge-base "$BASE_SHA" "pr-${PR_NUMBER}")
+          mkdir -p semantic-diff
+          node scripts/commitRecords.js --out semantic-diff/index.html "${base}..pr-${PR_NUMBER}"
+          echo "head=$(git rev-parse --short=9 "pr-${PR_NUMBER}")" >> "$GITHUB_OUTPUT"
+
+      - name: Setup Rclone
+        uses: cometkim/rclone-actions/setup-rclone@main
+
+      - name: Configure Rclone remote
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        with:
+          name: rescript
+          provider: Cloudflare
+          endpoint: https://${{ vars.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
+          access-key-id: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          acl: private
+
+      - name: Upload semantic diff
+        run: rclone copyto --s3-no-check-bucket semantic-diff/index.html "rescript:cdn-assets/semantic-diff/pr-${PR_NUMBER}/index.html"
+
+      # The query string names the rendered commit, so each push gets a URL
+      # that no cache has seen.
+      - name: Comment semantic diff URL
+        uses: thollander/actions-comment-pull-request@v3
+        with:
+          pr-number: ${{ github.event.pull_request.number }}
+          comment-tag: semantic-diff
+          message: |
+            Semantic diff: https://cdn.rescript-lang.org/semantic-diff/pr-${{ github.event.pull_request.number }}/index.html?v=${{ steps.render.outputs.head }}
+
+  cleanup:
+    if: >-
+      github.event.action == 'closed' &&
+      github.actor != 'dependabot[bot]' &&
+      (github.event_name == 'pull_request') ==
+      (github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-24.04
+    permissions: {}
+    steps:
+      - name: Setup Rclone
+        uses: cometkim/rclone-actions/setup-rclone@main
+
+      - name: Configure Rclone remote
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        with:
+          name: rescript
+          provider: Cloudflare
+          endpoint: https://${{ vars.CLOUDFLARE_ACCOUNT_ID }}.r2.cloudflarestorage.com
+          access-key-id: ${{ secrets.CLOUDFLARE_R2_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.CLOUDFLARE_R2_SECRET_ACCESS_KEY }}
+          acl: private
+
+      - name: Delete semantic diff
+        continue-on-error: true
+        run: rclone purge --s3-no-check-bucket "rescript:cdn-assets/semantic-diff/pr-${{ github.event.pull_request.number }}"