fix(actions): isolate apply-optimize from issue comments

.github/workflows/skill-apply-optimize-run.yml

@@ -0,0 +1,29 @@
+name: Apply Skill Optimization Run
+on:
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: Pull request number to apply the latest Tessl optimization to
+        required: true
+        type: string
+
+concurrency:
+  group: skill-apply-optimize-${{ inputs.pr_number }}
+  cancel-in-progress: false
+
+jobs:
+  apply:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Apply latest Tessl optimization
+        run: node tools/scripts/apply_skill_optimization.cjs
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ inputs.pr_number }}

.github/workflows/skill-apply-optimize.yml

@@ -1,21 +1,86 @@
-name: Apply Skill Optimization
+name: Queue Skill Optimization Apply
 on:
   issue_comment:
     types: [created]
 
 jobs:
-  apply:
+  queue:
     if: >-
       github.event.issue.pull_request &&
       contains(github.event.comment.body, '/apply-optimize')
     runs-on: ubuntu-latest
     permissions:
-      pull-requests: write
-      contents: write
+      actions: write
+      contents: read
+      issues: write
+      pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/github-script@v7
         with:
-          ref: ${{ github.event.issue.pull_request.head.ref }}
-      - uses: tesslio/skill-review-and-optimize@d81583861aaf29d1da7f10e6539efef4e27b0dd5
-        with:
-          mode: 'apply'
+          github-token: ${{ github.token }}
+          script: |
+            const trusted = new Set(['OWNER', 'MEMBER', 'COLLABORATOR']);
+            const prNumber = context.payload.issue?.number;
+            const association = context.payload.comment?.author_association ?? 'NONE';
+
+            if (!prNumber) {
+              core.setFailed('No pull request number found in issue_comment payload.');
+              return;
+            }
+
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+
+            if (!trusted.has(association)) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body:
+                  '⚠️ `/apply-optimize` can only be queued by repository maintainers ' +
+                  '(OWNER, MEMBER, or COLLABORATOR).',
+              });
+              return;
+            }
+
+            if (pr.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: prNumber,
+                body:
+                  '⚠️ `/apply-optimize` only auto-applies for pull requests whose head branch ' +
+                  'lives in this repository. Fork PRs must apply the suggested changes manually.',
+              });
+              return;
+            }
+
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'skill-apply-optimize-run.yml',
+              ref: context.payload.repository.default_branch,
+              inputs: {
+                pr_number: String(prNumber),
+              },
+            });
+
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'eyes',
+            });
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: prNumber,
+              body:
+                '👀 Queued the trusted `/apply-optimize` workflow for this PR. ' +
+                'It will fetch the repository branch from a separate workflow and apply the ' +
+                'latest Tessl optimization suggestion if one is available.',
+            });