[ty] Deploy ecosystem diff to Cloudflare pages (#19234)

## Summary

Changes the ecosystem-analyzer workflow to deploy the diff to Cloudflare
pages and post a link in the PR. Also adds a summary statistics to that
PR comment.

## Test Plan

The comment below:
https://github.com/astral-sh/ruff/pull/19234#issuecomment-3053205937. I
previously had some dummy changes on this PR to see a non-zero diff. And
I didn't reapply the label after I reverted that change, such that it's
still visible for reviewers.

.github/workflows/ty-ecosystem-analyzer.yaml

@@ -17,6 +17,7 @@ env:
   RUSTUP_MAX_RETRIES: 10
   RUST_BACKTRACE: 1
   REF_NAME: ${{ github.ref_name }}
+  CF_API_TOKEN_EXISTS: ${{ secrets.CF_API_TOKEN != '' }}
 
 jobs:
   ty-ecosystem-analyzer:
@@ -63,7 +64,7 @@ jobs:
 
           cd ..
 
-          uv tool install "git+https://github.com/astral-sh/ecosystem-analyzer@9c34dc514ee9aef6735db1dfebb80f63acbc3440"
+          uv tool install "git+https://github.com/astral-sh/ecosystem-analyzer@465d4039e28eea1b6b0ba50e989ab84660bb40f1"
 
           ecosystem-analyzer \
             --repository ruff \
@@ -79,16 +80,63 @@ jobs:
             --commit new_commit \
             --output diagnostics_new.json
 
+          mkdir dist
+
           ecosystem-analyzer \
             generate-diff \
             diagnostics_old.json \
             diagnostics_new.json \
             --old-name "main (merge base)" \
             --new-name "$REF_NAME" \
-            --output-html diff.html
+            --output-html dist/diff.html
 
-      - name: Upload HTML diff report
+          ecosystem-analyzer \
+            generate-diff-statistics \
+            diagnostics_old.json \
+            diagnostics_new.json \
+            --old-name "main (merge base)" \
+            --new-name "$REF_NAME" \
+            --output diff-statistics.md
+
+          echo '## `ecosystem-analyzer` results' > comment.md
+          echo >> comment.md
+          cat diff-statistics.md >> comment.md
+
+          cat diff-statistics.md >> "$GITHUB_STEP_SUMMARY"
+
+          echo ${{ github.event.number }} > pr-number
+
+      - name: "Deploy to Cloudflare Pages"
+        if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
+        id: deploy
+        uses: cloudflare/wrangler-action@da0e0dfe58b7a431659754fdf3f186c529afbe65 # v3.14.1
+        with:
+          apiToken: ${{ secrets.CF_API_TOKEN }}
+          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+          command: pages deploy dist --project-name=ty-ecosystem --branch ${{ github.head_ref }} --commit-hash ${GITHUB_SHA}
+
+      - name: "Append deployment URL"
+        if: ${{ env.CF_API_TOKEN_EXISTS == 'true' }}
+        env:
+          DEPLOYMENT_URL: ${{ steps.deploy.outputs.pages-deployment-alias-url }}
+        run: |
+          echo >> comment.md
+          echo "**[Full report with detailed diff]($DEPLOYMENT_URL/diff)**" >> comment.md
+
+      - name: Upload comment
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: comment.md
+          path: comment.md
+
+      - name: Upload pr-number
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: pr-number
+          path: pr-number
+
+      - name: Upload diagnostics diff
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: diff.html
-          path: diff.html
+          path: dist/diff.html

.github/zizmor.yml

@@ -10,6 +10,7 @@ rules:
     ignore:
       - build-docker.yml
       - publish-playground.yml
+      - ty-ecosystem-analyzer.yaml
   excessive-permissions:
     # it's hard to test what the impact of removing these ignores would be
     # without actually running the release workflow...