fix(ci): run policy gate for release PRs

[jbdevprimary]

Summary

• run the read-only, no-checkout repository policy gate in pull_request context
• retain external control-plane protection with only contents and pull-request read permissions
• permit GitHub App release PRs to satisfy the required gate without a maintainer approval

Validation

• actionlint .github/workflows/*.yml
• tox -e py313 (804 passed)

[coderabbitai]

Warning

Review limit reached

Next included review available in 41 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 65a3c83d-5259-472d-98ab-2864af739c81

📥 Commits

Reviewing files that changed from the base of the PR and between dc6fbe6 and 7c54332.

📒 Files selected for processing (2)

• .github/workflows/repository-policy.yml
• packages/extended-data/tests/core/test_release_hygiene.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

The changes correctly implement the migration from pull_request_target to pull_request context for the repository policy gate, improving security by ensuring external fork PRs run with read-only permissions. The new test adequately validates the workflow configuration requirements. No blocking issues identified.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c543324cb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the policy gate outside the untrusted merge ref

For an external PR that edits repository-policy.yml, the pull_request event executes the workflow definition from the PR's merge ref, so the contributor can remove the changed-file rejection or replace it with a successful step while still producing the required Repository Policy / gate check. This defeats the external control-plane protection enforced below; keep this enforcement in a trusted base-branch context such as pull_request_target, or use another policy mechanism that the PR cannot modify.

Useful? React with 👍 / 👎.