fix(ci): replace ISF gh pr create with a job-summary PR link

[Roland Krummenacher (RolandKrummenacher)]

Summary

The Update Instance Size Flexibility workflow has failed on every scheduled run since 17 August (run 32000829915, 32696676461, 33364273736). The failing step is Create PR if data changed:

pull request create failed: GraphQL: GitHub Actions is not permitted to
create or approve pull requests (createPullRequest)

The org has Allow GitHub Actions to create and approve pull requests disabled, and the org policy overrides the workflow's own pull-requests: write.

The break was latent, not new. The step was added on 12 Aug in fa19ad6. The 3 and 10 August runs went green only because they detected no data changes and exited at No changes detected before reaching gh pr create — verified in the 10 Aug log. 17 August was the first run with something to publish, and it has failed the same way every week since.

The fetch and the branch push both succeed — only the PR call fails. So each failed run left an orphan branch behind, and all three carry the identical one-row update:

"NVadsA10_v5 DedicatedHost","nvadsa10v5_type1","72"

Fix

opendata-commitment-eligibility.yml already hit this exact wall and solved it, with a comment saying so. This aligns the ISF workflow with that pattern rather than inventing a second approach: push the branch, then write a one-click compare/dev...$BRANCH?expand=1 link into the job summary for a maintainer to open. Opening the PR from there still triggers Open Data CI and normal review.

The suggested title and body are emitted into the job summary as fenced blocks, so the wording the old PR_BODY carried isn't lost — it's copy-pasteable when opening the PR.

Also in scope:

• Drops the now-unused pull-requests: write permission and the GITHUB_TOKEN env var. contents: write (push) and id-token: write (OIDC) stay.
• Appends run_number to the branch name, so a same-day re-run can't collide with the branch an earlier run already pushed. Matches the sibling workflow.

Not in scope

The pending data row is being opened as a separate PR from the newest orphan branch, and the two redundant orphan branches removed. This PR is workflow-only.

No changelog entry — CI-only change with no effect on any shipped artifact, consistent with the other workflow-only PRs (#2242, #2233, #2244).

Test plan

• yaml.safe_load parses the workflow; permissions resolves to {contents: write, id-token: write} and the step list is unchanged apart from the renamed final step
• bash -n on the extracted run: script with the ${{ }} expressions stubbed
• Rendered the job-summary block with a stub BRANCH/PR_URL and confirmed the markdown, the compare link, and both fenced blocks come out correctly
• Invoke-Pester ./src/powershell/Tests/Unit/Update-InstanceSizeFlexibility.Tests.ps1 — 15/15 pass (no assertions on the workflow file, run as a regression check)
• workflow_dispatch on this branch after merge to confirm a real run reaches the summary link

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes the Update Instance Size Flexibility GitHub Actions workflow so it no longer attempts to open a PR via gh pr create (which is blocked by org policy). Instead, when data changes are detected, it pushes a branch and writes a one-click compare/dev...<branch> link plus suggested PR title/body into the job summary for a maintainer to open manually.

Changes:

• Remove pull-requests: write permission and the gh pr create step that fails under org policy.
• Push a data-update branch and emit a “Create pull request” compare link + suggested PR text into $GITHUB_STEP_SUMMARY.
• Append a run identifier to the branch name to reduce collisions with existing pushed branches.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[microsoft-github-policy-service]

All Contributors (@all-contributors) please add Roland Krummenacher (@RolandKrummenacher) for code

[allcontributors]

@microsoft-github-policy-service[bot]

Roland Krummenacher (@RolandKrummenacher) already contributed before to code