build(deps): bump benchmark publisher to 1.0.4

[cpunion]

Summary

• bump the reusable benchmark publisher from v1.0.3 to v1.0.4
• restore benchmark comments for pull requests whose head commit is in a fork

Why

The v1.0.3 publisher falls back to the upstream commit-to-pulls endpoint when a workflow-run payload has no pull request number. GitHub returns no association for these fork commit SHAs, so publishing stops at Classify source series with cannot resolve pull request before downloading artifacts or creating a comment.

v1.0.4 resolves the open pull request by the fork owner and branch, then verifies the repository, branch, and head SHA. This directly addresses the failed publisher runs for #2312 and #2313.

Dependabot PR #2278 was created while v1.0.3 was the latest release. v1.0.4 was published later and was still inside GitHub's default three-day version-update cooldown when these failures occurred, so Dependabot had not proposed the publisher update yet.

The source benchmark jobs already succeeded. Because the publisher is triggered through workflow_run from the default branch, affected benchmark runs should be rerun after this change reaches main.

Validation

• verified that the v1.0.4 lookup resolves the current heads to cl: preserve unnamed rangefunc defer results #2312 and test/goroot: classify precise GC and nil-check cases #2313
• parsed .github/workflows/benchmark-publish.yml
• git diff --check

[fennoai]

Review summary

This PR bumps the reusable benchmark-publish workflow reference from @v1.0.3 to @v1.0.4 in .github/workflows/benchmark-publish.yml. It's a clean, low-risk, well-scoped change:

• The new tag is consistent with the companion reference at .github/workflows/benchmark.yml:81, which already pins @v1.0.4, so the record and publish steps stay in sync.
• A repo-wide grep finds no lingering v1.0.3 references, and the referenced .github/llgo-benchmark.yml config still exists.
• No performance or documentation concerns.

No blocking issues. One pre-existing (not introduced by this PR) hardening suggestion is noted inline.

[fennoai]

Informational (pre-existing, not introduced by this PR): this reusable workflow runs via workflow_run with contents: write / issues: write / pull-requests: write but is pinned to a mutable tag (@v1.0.4). A tag can be force-moved upstream, so it doesn't give the integrity guarantee of a commit SHA. For a write-privileged third-party workflow, consider pinning to a full commit SHA (e.g. ...publish.yml@<40-char-sha> # v1.0.4). The same applies to benchmark.yml:81; out of scope for this bump, just flagging.

[cpunion]

Addressed in db03150. Both the benchmark recorder and the write-privileged reusable publisher are now pinned to the full v1.0.4 release commit SHA, with the version comment retained for Dependabot.

[cpunion]

Restored both references to @v1.0.4 in 1b8c114. These repositories share the xgo-dev trust boundary, and this PR remains focused on the publisher bug fix; commit pinning can be considered separately if the project adopts it consistently.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!