ci(qa): upsert Mantis PR comments by marker

.github/workflows/mantis-discord-status-reactions.yml

@@ -451,7 +451,6 @@ jobs:
           baseline_status="$(jq -r '.baseline.status' "$root/comparison.json")"
           candidate_status="$(jq -r '.candidate.status' "$root/comparison.json")"
           pass="$(jq -r '.pass' "$root/comparison.json")"
-          mantis_bot_login="$(gh api user --jq '.login')"
           comment_file="$(mktemp)"
           cat > "$comment_file" <<EOF
           <!-- mantis-discord-status-reactions -->
@@ -476,7 +475,7 @@ jobs:
 
           comment_id="$(
             gh api --paginate "repos/${GITHUB_REPOSITORY}/issues/${TARGET_PR}/comments" \
-              --jq ".[] | select(.body | contains(\"<!-- mantis-discord-status-reactions -->\")) | select(.user.login == \"${mantis_bot_login}\") | .id" \
+              --jq '.[] | select(.body | contains("<!-- mantis-discord-status-reactions -->")) | .id' \
               | tail -n 1
           )"
 

docs/concepts/mantis.md

@@ -377,9 +377,9 @@ messages, and other bulky evidence stay in the Actions artifact.
 Production workflows should post those comments with the Mantis GitHub App, not
 with `github-actions[bot]`. Store the app id and private key as
 `MANTIS_GITHUB_APP_ID` and `MANTIS_GITHUB_APP_PRIVATE_KEY` GitHub Actions
-secrets. The workflow resolves the bot login from the GitHub App token, updates
-an existing Mantis-owned comment when one exists, and creates a new Mantis-owned
-comment instead of rewriting older `github-actions[bot]` comments.
+secrets. The workflow uses a hidden marker as the upsert key, updates that
+comment when the token can edit it, and creates a new Mantis-owned comment when
+an older bot-owned marker cannot be edited.
 
 The PR comment should be short and visual: