fix: checkout first, scope artifact download to subdirectory, skip bots on remove job

- Move checkout before artifact download so project files are
  established in the workspace before any untrusted artifact data
  lands, preventing potential file overwrites
- Add path: artifact to download-artifact so the JSON file is scoped
  to a subdirectory instead of the workspace root; update readFileSync
  path accordingly
- Add bot-skip condition to the remove job using
  workflow_run.triggering_actor.login so the job exits early for bot
  actors even if an artifact somehow exists

Signed-off-by: Mounil Kanakhara <mounilkankhara@gmail.com>

Author: Mounil2005

.github/workflows/on-review.yml

@@ -61,14 +61,20 @@ jobs:
     runs-on: hl-sdk-py-lin-md
     if: |
       github.event_name == 'workflow_run' &&
-      github.event.workflow_run.conclusion == 'success'
+      github.event.workflow_run.conclusion == 'success' &&
+      !contains(github.event.workflow_run.triggering_actor.login, '[bot]')
 
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
       - name: Check for review artifact
         id: check
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -81,7 +87,7 @@ jobs:
               run_id: context.payload.workflow_run.id
             });
             const found = data.artifacts.some(a => a.name === name && !a.expired);
-            if (!found) core.notice('Review artifact not found; capture job was likely skipped for a bot actor. Nothing to do.');
+            if (!found) core.notice('Review artifact not found; capture job was likely skipped. Nothing to do.');
             core.setOutput('found', String(found));
 
       - name: Download review metadata
@@ -91,20 +97,15 @@ jobs:
           name: review-data-${{ github.event.workflow_run.id }}
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Checkout repository
-        if: steps.check.outputs.found == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
+          path: artifact
 
       - name: Run Remove Reviewer from Assignees
         if: steps.check.outputs.found == 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
-            const raw = JSON.parse(fs.readFileSync('review.json', 'utf8'));
+            const raw = JSON.parse(fs.readFileSync('artifact/review.json', 'utf8'));
             const reviewer = typeof raw.reviewer === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9-]*$/.test(raw.reviewer)
               ? raw.reviewer : null;
             const prNumber = Number.isInteger(raw.pr_number) && raw.pr_number > 0