Due to the limitations of the read-only GitHub token that's available when running a PR from a fork, it's not possible for an Action to post comments on its own. I've designed a workaround for this that revolves around uploading a JSON file as an artifact, and then have a bot post the comments on behalf of the action.