[ci] Updated CI failure bot caller: permissions, PR author

Author: stktyagi

.github/workflows/bot-ci-failure.yml

@@ -7,7 +7,7 @@ on:
       - completed
 
 permissions:
-  pull-requests: write
+  pull-requests: read
   actions: read
   contents: read
 
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   find-pr:
     runs-on: ubuntu-latest
-    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    if: ${{ github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event == 'pull_request' }}
     outputs:
       pr_number: ${{ steps.pr.outputs.number }}
       pr_author: ${{ steps.pr.outputs.author }}
@@ -34,9 +34,10 @@ jobs:
           emit_pr() {
             local pr_number="$1"
             local pr_author
-            pr_author=$(gh pr view "$pr_number" --repo "$REPO" --json author --jq '.author.login' 2>/dev/null || echo "")
+            pr_author=$(gh pr view "$pr_number" --repo "$REPO" --json author --jq '.author.login // empty' 2>/dev/null || echo "")
             if [ -z "$pr_author" ]; then
-              echo "::warning::Could not fetch PR author for PR #$pr_number"
+              pr_author="${{ github.event.workflow_run.actor.login }}"
+              echo "::warning::Could not fetch PR author for PR #$pr_number; falling back to @$pr_author"
             fi 
             echo "number=$pr_number" >> "$GITHUB_OUTPUT"
             echo "author=$pr_author" >> "$GITHUB_OUTPUT"
@@ -49,7 +50,7 @@ jobs:
           fi
           HEAD_SHA="$EVENT_HEAD_SHA"
           echo "Payload empty. Searching for PR via Commits API..."
-          PR_NUMBER=$(gh api repos/$REPO/commits/$HEAD_SHA/pulls -q '.[0].number' 2>/dev/null || true)
+          PR_NUMBER=$(gh api repos/$REPO/commits/$HEAD_SHA/pulls -q '[.[] | select(.state == "open")][0].number' 2>/dev/null || true)
           if [ -n "$PR_NUMBER" ] && [ "$PR_NUMBER" != "null" ]; then
              echo "Found PR #$PR_NUMBER using Commits API."
              emit_pr "$PR_NUMBER"
@@ -68,6 +69,10 @@ jobs:
   call-ci-failure-bot:
     needs: find-pr
     if: ${{ needs.find-pr.outputs.pr_number != '' }}
+    permissions:
+      pull-requests: write
+      actions: write
+      contents: read
     uses: openwisp/openwisp-utils/.github/workflows/reusable-bot-ci-failure.yml@master
     with:
       pr_number: ${{ needs.find-pr.outputs.pr_number }}