fix: address Copilot code review feedback

- Move early return condition to after stale label determination to ensure stale labels are always removed
- Add 'maintain' role to privileged approval permission levels
- Downgrade pull-requests permission to 'read' to enforce least privilege

Signed-off-by: darshit2308 <darshit2308@gmail.com>

Author: darshit2308

.github/scripts/review-sync/labels.js

@@ -137,7 +137,7 @@ async function countApprovals(github, owner, repo, prNumber) {
 
     const permission = await getPermissionLevel(github, owner, repo, username);
 
-    if (permission === 'admin' || permission === 'write') {
+    if (permission === 'admin' || permission === 'maintain' || permission === 'write') {
       writeApproval++;
     } else {
       // read, none, or any unexpected value → soft approval
@@ -205,17 +205,17 @@ async function syncLabel(github, owner, repo, pr, dryRun) {
     `→ ${correctLabel.name}`
   );
 
-  // Check if the correct label is already present
-  if (currentLabels.includes(correctLabel.name)) {
-    console.log(`    ✓ Already has "${correctLabel.name}". No change needed.`);
-    return false;
-  }
-
   // Determine which stale queue labels to remove
   const staleLabels = currentLabels.filter(
     (name) => ALL_QUEUE_LABEL_NAMES.includes(name) && name !== correctLabel.name
   );
 
+  // Check if the correct label is already present AND there are no stale labels to remove
+  if (currentLabels.includes(correctLabel.name) && staleLabels.length === 0) {
+    console.log(`    ✓ Already has "${correctLabel.name}". No change needed.`);
+    return false;
+  }
+
   if (dryRun) {
     console.log(`    [DRY RUN] Would add "${correctLabel.name}".`);
     if (staleLabels.length > 0) {

.github/workflows/review-sync.yml

@@ -23,7 +23,7 @@ on:
         type: string
 
 permissions:
-  pull-requests: write
+  pull-requests: read
   issues: write
   contents: read