[gha-win-mac] Add package link to PR status

[xmkg]

Add Win/Mac package links to the CI status section for convenience.

[Copilot]

Pull request overview

Adds Windows/macOS package download links into the PR “Checks” area by publishing a commit status that points at the S3 package URL, improving discoverability of CI artifacts for reviewers.

Changes:

• Grant statuses: write where needed so workflows can publish commit statuses.
• Post a commit status after successful S3 upload for Windows and macOS package builds, linking directly to the published package.
• Update the dynamic CI caller workflow permissions to allow reusable workflows to set commit statuses.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
.github/workflows/windows.yml	Grants statuses: write and posts a “Package / …” commit status pointing to the Windows S3 package URL.
.github/workflows/macos.yml	Grants statuses: write for the combine/publish job and posts a “Package / macOS” commit status pointing to the macOS S3 package URL.
.github/workflows/dynamic-ci.yml	Adds statuses: write at the caller workflow level so the reusable Windows/macOS workflows can publish statuses.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[xmkg]

Bogus. The dispatching workflow needs to have the same permissions.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

.github/workflows/dynamic-ci.yml:18

• statuses: write is added at the workflow level, which grants this permission to all jobs in dynamic-ci.yml (including jobs that don’t create commit statuses). Since the permission is only needed to allow the called Windows/macOS reusable workflows to post a status, consider scoping statuses: write to just the windows/macos (and any other relevant) reusable-workflow call jobs via job-level permissions, instead of the whole workflow.

permissions:
  contents: read
  checks: write
  actions: read
  packages: write
  statuses: write

[ricab]

It makes sense for statuses: write to be paired with packages: write and splitting package uploading into a separate job is out for scope for this PR.

[ricab]

Actually, scratch that. I thought the package upload was what needed the packages: write, but that's not true because we're using our own upload here.

So statuses: write becomes the first permission needed for the task of uploading packages and posting the link, so this arguably introduces the first need for a split along that seam.

It shouldn't be too hard to split the upload into a separate job since that's the case with macOS today (because of the package combining). @xmkg WDYT? Would there be any significant difficulties?

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.36%. Comparing base (3474a63) to head (baea4a9).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5102   +/-   ##
=======================================
  Coverage   73.36%   73.36%           
=======================================
  Files         332      332           
  Lines       17937    17937           
=======================================
  Hits        13158    13158           
  Misses       4779     4779           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ricab]

Thank you @xmkg, this will make it a breeze to get those links 😃

Please let me know your thoughts on the copilot thread I commented on.

One note: we're the only users of the S3 upload action. If we want to continue using, we'd better adopt it. Or we could just deal with the zip on GitHub...