[CI] Gate /rerun-test on commenter trust and remove /rerun-stage (#35750)

.github/workflows/pr-test-amd-rocm720.yml

@@ -1,5 +1,5 @@
 name: PR Test ROCm 7.2 (AMD)
-# Dynamic run-name for /rerun-stage commands to enable URL lookup
+# Dynamic run-name for manual stage dispatches to enable URL lookup
 # Format: "[stage-name] sha" for fork PRs, "[stage-name]" for non-fork, default for normal runs
 run-name: ${{ (inputs.target_stage || inputs.target_stage_select) && (inputs.pr_head_sha && format('[{0}] {1}', inputs.target_stage || inputs.target_stage_select, inputs.pr_head_sha) || format('[{0}]', inputs.target_stage || inputs.target_stage_select)) || '' }}
 
@@ -56,7 +56,7 @@ on:
         type: string
         default: ""
       pr_head_sha:
-        description: "PR head SHA to checkout (for /rerun-stage on fork PRs)"
+        description: "PR head SHA to checkout (for stage dispatches on fork PRs)"
         required: false
         type: string
         default: ""
@@ -239,7 +239,7 @@ jobs:
   # pr-test.yml's `call-pr-test-extra`. On `schedule` (and run_all_tests
   # dispatch) the extra suite runs on `main` without needing the
   # `run-ci-extra` label (pr-gate.yml only enforces labels on pull_request
-  # events). Targeted /rerun-stage dispatches (target_stage set) are excluded.
+  # events). Targeted stage dispatches (target_stage set) are excluded.
   # Not added to `pr-test-amd-rocm720-finish` so the base AMD gate never depends on
   # the opt-in extra suite.
   call-pr-test-amd-extra-rocm720:

.github/workflows/pr-test-amd.yml

@@ -1,5 +1,5 @@
 name: PR Test ROCm 7.0 (AMD)
-# Dynamic run-name for /rerun-stage commands to enable URL lookup
+# Dynamic run-name for manual stage dispatches to enable URL lookup
 # Format: "[stage-name] sha" for fork PRs, "[stage-name]" for non-fork, default for normal runs
 run-name: ${{ (inputs.target_stage || inputs.target_stage_select) && (inputs.pr_head_sha && format('[{0}] {1}', inputs.target_stage || inputs.target_stage_select, inputs.pr_head_sha) || format('[{0}]', inputs.target_stage || inputs.target_stage_select)) || '' }}
 
@@ -43,7 +43,7 @@ on:
         type: string
         default: ""
       pr_head_sha:
-        description: "PR head SHA to checkout (for /rerun-stage on fork PRs)"
+        description: "PR head SHA to checkout (for stage dispatches on fork PRs)"
         required: false
         type: string
         default: ""
@@ -209,7 +209,7 @@ jobs:
   # pr-test.yml's `call-pr-test-extra`. On `schedule` (and run_all_tests
   # dispatch) the extra suite runs on `main` without needing the
   # `run-ci-extra` label (pr-gate.yml only enforces labels on pull_request
-  # events). Targeted /rerun-stage dispatches (target_stage set) are excluded.
+  # events). Targeted stage dispatches (target_stage set) are excluded.
   # Not added to `pr-test-amd-finish` so the base AMD gate never depends on
   # the opt-in extra suite.
   call-pr-test-amd-extra:

.github/workflows/rerun-test.yml

@@ -72,8 +72,9 @@ env:
   # every run, so a rerun holding the write token could become everyone's next
   # comparison baseline. Without the repo var it fails fast instead.
 
+# Every job below sets its own `permissions`, which replaces rather than merges
+# with a workflow-level block -- so keep the floor here minimal and grant per job.
 permissions:
-  actions: write
   contents: read
   issues: read
 
@@ -93,6 +94,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.pr_head_sha || github.sha }}
+          # This checkout can hold a fork's code that the steps below execute;
+          # without this the job token stays in .git/config, readable by it.
+          persist-credentials: false
 
       - name: Mark runner picked up
         if: inputs.reply_comment_id != '' && inputs.reply_marker != ''
@@ -188,6 +192,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.pr_head_sha || github.sha }}
+          # This checkout can hold a fork's code that the steps below execute;
+          # without this the job token stays in .git/config, readable by it.
+          persist-credentials: false
 
       - name: Mark runner picked up
         if: inputs.reply_comment_id != '' && inputs.reply_marker != ''
@@ -262,6 +269,9 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.pr_head_sha || github.sha }}
+          # This checkout can hold a fork's code that the steps below execute;
+          # without this the job token stays in .git/config, readable by it.
+          persist-credentials: false
 
       - name: Mark runner picked up
         if: inputs.reply_comment_id != '' && inputs.reply_marker != ''

.github/workflows/slash-command-handler.yml

@@ -19,7 +19,6 @@ jobs:
       (contains(github.event.comment.body, '/tag-run-ci-label') ||
        contains(github.event.comment.body, '/rerun-failed-ci') ||
        contains(github.event.comment.body, '/tag-and-rerun-ci') ||
-       contains(github.event.comment.body, '/rerun-stage') ||
        contains(github.event.comment.body, '/rerun-group') ||
        contains(github.event.comment.body, '/rerun-test'))
     runs-on: ubuntu-latest