Hand a detached GitHub Actions run's check to its attach

[epompeii]

Breaking:

• bencher run --detach --github-actions requires the new --ci-callback-token, refused before the run starts, since nothing else would complete the check it starts. A workflow that detaches with --github-actions and no callback token fails.
• An empty or blank --github-actions token, such as an unset secret, is refused as it parses, with a message that says to check the secret. A workflow that passes an unset secret fails before the run starts, off GitHub Actions and on events other than a pull request too.

On GitHub Actions a bare metal run can submit its job without holding a runner for the length of the benchmark. Workflow 1 submits and exits; Bencher sends a repository_dispatch when the job finishes; workflow 2 attaches and posts the results on workflow 1's check and pull request.

Workflow 1: --detach with --github-actions and --ci-callback-token.

• bencher run starts the in-progress check, composes the callback, submits, prints the report, posts nothing else, and exits zero. A callback that fails to compose fails the check and submits nothing.
• The callback is a repository_dispatch with event type bencher_run to the repository's dispatches endpoint under the GitHub API URL, authorized by --ci-callback-token: a fine-grained personal access token with contents write on the one repository, since the workflow's own token has expired by the time the job finishes.
• The client_payload holds two snake_case objects, and an absent value has no key. bencher holds the project slug and the job UUID as placeholders, which workflow 2 reads, and the run's ci_id, its pull request as ci_number, and its build_time and file_size flags. github holds the head sha the check was started at and the check.
• --callback-url conflicts with --github-actions. An empty or blank --ci-callback-token is refused as it parses, with the same message as --github-actions. Both tokens are Secret, so a release build never prints them.
• The server sends the dispatch to api.github.com on every plan, and a dispatch to GitHub Enterprise Server is an ordinary callback that needs a paid plan. A callback the server skips completes the check as neutral with the notice. If the job cannot be read after submitting, the check stays in progress for workflow 2, with a warning.

Workflow 2: bencher run --job on a repository_dispatch event.

• It reads client_payload: it completes the check workflow 1 started, or creates one at the payload's head SHA, and comments on the payload's pull request under the same tag as workflow 1, from its ci_id and flags. An explicit --ci-number or --ci-id wins.
• The payload's check is taken before the version and safety checks, so an error there still fails it.
• A malformed payload is ignored with a warning, and the attach goes on as on any other event.

Fix: a remote job that fails or is canceled completes its GitHub Check as failure or cancelled, whatever its alerts, for an attached bencher run --image as well.

No automated test runs three paths end to end, because the local stand-in for the GitHub API is http and a callback must be https: the check id's path from the started check into the payload (each step on it is unit tested), the neutral completion of a skipped callback's check, and the warning when the job cannot be read back after submitting. An end-to-end run on GitHub Actions against the dev deployment covered the first, and the second before the dispatch to api.github.com went out on every plan.

Needed for #1046

[github-actions]

Bencher Report

Project	Bencher
Branch	u/ep/callback/github
Testbed	intel-v1

Click to view all benchmark results

Benchmark	Latency	Benchmark Result microseconds (µs) (Result Δ%)	Upper Boundary microseconds (µs) (Limit %)
Adapter::Json	📈 view plot 🚷 view threshold	5.18 µs (+4.70%) Baseline: 4.95 µs	6.02 µs (86.03%)
Adapter::Magic (JSON)	📈 view plot 🚷 view threshold	4.97 µs (+4.00%) Baseline: 4.78 µs	5.70 µs (87.18%)
Adapter::Magic (Rust)	📈 view plot 🚷 view threshold	27.97 µs (+4.51%) Baseline: 26.76 µs	30.35 µs (92.16%)
Adapter::Rust	📈 view plot 🚷 view threshold	4.68 µs (+13.86%) Baseline: 4.11 µs	6.42 µs (72.93%)
Adapter::RustBench	📈 view plot 🚷 view threshold	4.68 µs (+14.03%) Baseline: 4.10 µs	6.39 µs (73.23%)

🐰 View full continuous benchmarking report in Bencher