fix: validate artifact contents before use to prevent artifact poisoning

CodeQL flagged the download-artifact + require() pattern as artifact
poisoning: data written by an external user in the capture workflow
flows into a write-token context without validation. Validate reviewer
login against the GitHub login charset (alphanumeric and hyphens) and
confirm pr_number is a positive integer before passing either value to
the removal function. Fails the step with a clear message if contents
are unexpected.

Signed-off-by: Mounil Kanakhara <mounilkankhara@gmail.com>

Author: Mounil2005

.github/workflows/on-review.yml

@@ -90,6 +90,14 @@ jobs:
         with:
           script: |
             const fs = require('fs');
-            const { reviewer, pr_number: prNumber } = JSON.parse(fs.readFileSync('review.json', 'utf8'));
+            const raw = JSON.parse(fs.readFileSync('review.json', 'utf8'));
+            const reviewer = typeof raw.reviewer === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9-]*$/.test(raw.reviewer)
+              ? raw.reviewer : null;
+            const prNumber = Number.isInteger(raw.pr_number) && raw.pr_number > 0
+              ? raw.pr_number : null;
+            if (!reviewer || !prNumber) {
+              core.setFailed(`Invalid artifact contents: reviewer=${raw.reviewer}, pr_number=${raw.pr_number}`);
+              return;
+            }
             const { removeReviewerFromAssignees } = require('./.github/scripts/bot-pr-add-reviewers-as-assignees.js');
             await removeReviewerFromAssignees({ github, context, reviewer, prNumber });