We need to use the issue-write workflow to write the comments, because pull_request targets don't have permissions to write comments.
https://pip.pypa.io/en/stable/topics/secure-installs/
We have been collecting release notes from the PRs for most of the 18.1.x releases and this just helps automate the process.