Request a Review Automatically on Green CI

# .github/workflows/prflow-auto-review.yml
# Requests a PRFlow /prflow:review automatically once your CI is green on a
# non-draft, same-repository pull request. Safe ONLY under `pull_request`
# (see the hard precondition above — never `pull_request_target`).
name: PRFlow auto-review request
on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
permissions:
  contents: read
jobs:
  request-review:
    # Replace `ci` with YOUR own CI job(s). This `needs:` IS the success gate:
    # because the `if:` below uses no status function (`always()`, `!cancelled()`,
    # `success()`, `failure()`), GitHub skips this job unless every `needs:` job
    # succeeded. Adding one of those functions REMOVES that implicit gate — if you
    # do, add your own `needs.<job>.result == 'success'` clauses to the steps that
    # mint the token and post, or a red CI run will request a review.
    needs: [ci]
    # These five eligibility clauses are the safety gate. Do not edit them.
    if: >-
      github.event_name == 'pull_request' &&
      github.event.pull_request.draft == false &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      github.actor != 'dependabot[bot]' &&
      vars.DEVFLOW_APP_ID != ''
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      # The helper lives under .prflow/vendor/prflow/, where the installer put
      # the plugin, and the vendor-plugin action re-materializes it at run time.
      # The sparse checkout names both scripts/ and lib/ because the helper reads
      # files from both.
      - uses: actions/checkout@v6
        with:
          persist-credentials: false
          sparse-checkout: |
            .github/actions/vendor-plugin
            .prflow/vendor/prflow/scripts
            .prflow/vendor/prflow/lib
      - name: Materialize the vendored PRFlow helper tree
        uses: ./.github/actions/vendor-plugin
      - name: Mint downscoped comment token
        id: app_token
        uses: actions/create-github-app-token@v3
        with:
          client-id: ${{ vars.DEVFLOW_APP_ID }}
          private-key: ${{ secrets.DEVFLOW_APP_PRIVATE_KEY }}
          permission-pull-requests: write
      - name: Request a PRFlow review for this head
        env:
          GH_TOKEN: ${{ steps.app_token.outputs.token }}
          PR: ${{ github.event.pull_request.number }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          EXPECTED_AUTHOR: ${{ steps.app_token.outputs.app-slug }}
        run: |
          HELPER=.prflow/vendor/prflow/scripts/post-ci-review-trigger.sh
          # Absent-file breadcrumb: a consumer pinned below the version that
          # carries the helper gets a NAMED warning rather than an rc-127 red step.
          if [ ! -x "$HELPER" ]; then
            echo "::warning::PRFlow auto-review: helper not found at $HELPER — is prflow_version >= 2.30.18? Skipping (no review requested)."
            exit 0
          fi
          "$HELPER"