ci: copilot-review-gate (yellow until Copilot reviews)

[rafeekpro]

Automated deploy of the copilot-review-gate from lagowski/pr-review-gate.

After merge: enable the copilot-auto-review ruleset and make copilot-review a required check (the deployer's RULESET + ENFORCE phases). Do not edit the workflow here — change it centrally and redeploy.

[Copilot]

Pull request overview

Adds an automated GitHub Actions workflow that synthesizes a required copilot-review commit status to keep PRs in a pending/yellow state until GitHub Copilot has reviewed the current head commit, with a scheduled sweep to handle bot-trigger limitations and fork PR token restrictions.

Changes:

• Introduces copilot-review-gate workflow triggered on PR activity and a 5-minute cron backstop.
• Implements a GitHub Script step that detects Copilot’s review on the current head SHA and posts copilot-review as pending/success accordingly.
• Serializes runs via concurrency grouping to avoid overlapping status writes during scheduled sweeps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/workflows/copilot-review-gate.yml:33

• The comment about runner overrides contains a copy/paste typo ("overrides ubuntu-latest to ubuntu-latest"), which is confusing given the template’s intent (self-hosted by default, overridden to ubuntu-latest when needed).

# Zero LLM calls; short-lived runs on the configured runner (self-hosted by default → no
# GitHub minutes; a repo without a self-hosted runner overrides ubuntu-latest to ubuntu-latest,
# which IS metered — the job is seconds-long, so the cost is negligible).

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

.github/workflows/copilot-review-gate.yml:33

• The runner-cost comment has a copy/paste error: it says the repo “overrides ubuntu-latest to ubuntu-latest”, which is misleading (it should describe overriding from self-hosted to ubuntu-latest).

# Zero LLM calls; short-lived runs on the configured runner (self-hosted by default → no
# GitHub minutes; a repo without a self-hosted runner overrides ubuntu-latest to ubuntu-latest,
# which IS metered — the job is seconds-long, so the cost is negligible).

.github/workflows/copilot-review-gate.yml:118

• expectedForkDenial treats any 403 as an expected fork-token denial, but this job is already skipped for fork PRs on the pull_request event. As written, a real 403 (e.g. permissions/ruleset issue) would be logged as info instead of a warning, making failures harder to notice.

                const expectedForkDenial = e.status === 403;
                const log = expectedForkDenial ? core.info : core.warning;