* Add skill-coverage PR workflow with slash command support
- Auto-triggers on PRs that change plugins/** or tests/**
- Detects specific plugin/skill pairs from the PR diff
- Runs Measure-SkillCoverage.ps1 and posts a coverage report as a PR comment
- Supports /skill-coverage slash command on PR comments:
/skill-coverage (runs on changed skills in the PR)
/skill-coverage <plugin> (runs on all skills in the plugin)
/skill-coverage <plugin> <skill> (runs on a specific skill)
* Address Copilot review: security, permissions, and robustness fixes
- Add permission check: require write access before running slash command
- Tighten /skill-coverage matching to avoid false triggers on similar commands
- Add issues: write permission (PR comments use Issues API)
- Use refs/pull/<num>/head for checkout to support fork PRs
- Remove unused \ variable
- Fix multi-line JSON parsing with Out-String
* Address PR #538 review: fork PR handling, reactions, and sourcing note
- Skip PR comment posting for fork PRs (read-only token); coverage still runs in step summary
- Add continue-on-error to reaction step to avoid 403 failures
- Add header comment noting issue_comment trigger sources from default branch
- Add continue-on-error to no-changes comment step
* Split into analyze + comment jobs; fix pagination and dedup
Security:
- Split into two jobs: analyze (contents: read only) and comment (write only)
- Analyze job checks out base branch for trusted tooling, PR head into
a separate git worktree - untrusted PR code is never executed
- Comment job only reads an uploaded artifact, no PR code checkout
Fixes:
- Use github.paginate() for listComments to handle PRs with >100 comments
- Deduplicate targets: plugin-wide changes replace per-skill targets for
that plugin instead of producing duplicates
Amaury Levé