Fix re-request-review workflow for fork-originated PRs (privilege separation)

[Copilot]

For fork-originated PRs, GITHUB_TOKEN on pull_request_review events is read-only regardless of declared permissions, causing a 403 when calling github.rest.pulls.requestReviewers(). The error was also silently swallowed via core.warning().

Changes

• auto_assign_prs.yml — replaces the failing re-request-review job with a lightweight record-pr-number job that writes the PR number to an artifact. PR number is passed via env variable (not direct expression interpolation) to prevent shell injection. Preserves existing pull_request_target auto-assignment behavior unchanged.

• .github/workflows/re_request_review.yml (new) — privileged workflow_run workflow triggered after the above completes successfully:

  • Runs in base-repo context, receiving a write token even for fork PRs
  • Strictly validates artifact content with /^\d+$/ before use — artifact is treated as untrusted input, no PR code is checked out or executed
  • Fetches PR state and all reviews via paginated API calls; recounts approvals using same logic (sort by submitted_at, fold by user, check APPROVED)
  • Calls requestReviewers only when approval count is below threshold
  • Uses core.setFailed() on API errors — failures are no longer silent
  • Minimal permissions: actions: read + pull-requests: write

Please indicate you've done the following:

• Accepted the DCO. Commits without the DCO will delay acceptance.
• Created a changelog file (make new-changelog) or comment /kind changelog-not-required on this PR.
• Updated the corresponding documentation in site/content/docs/main.

[netlify]

✅ Deploy Preview for velero canceled.

Name	Link
🔨 Latest commit	c55559f
🔍 Latest deploy log	https://app.netlify.com/projects/velero/deploys/6a7fc191e5ddce0009149de6

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!