fix: use REST API for draft conversion to avoid contents:write permission

The GraphQL convertPullRequestToDraft mutation requires contents: write,
which raises security concerns for workflows triggered by fork PR reviews.
Switch to the REST API pulls.update endpoint with draft: true, which
works with the existing pull-requests: write permission.

- Replace graphql mutation with github.rest.pulls.update
- Remove node_id validation since we no longer need GraphQL node IDs
- Update mocks and assertions in tests accordingly

Addresses review feedback from exploreriii and darshit2308.
Signed-off-by: Gourav NSS <gourav341111@gmail.com>

Author: NssGourav

.github/scripts/revision-guard/helpers/draft.js

@@ -7,19 +7,13 @@ function isDraft(pr) {
   return pr?.draft === true;
 }
 
-async function convertToDraft(github, pullRequestId) {
-  await github.graphql(
-    `
-      mutation($pullRequestId: ID!) {
-        convertPullRequestToDraft(input: { pullRequestId: $pullRequestId }) {
-          pullRequest {
-            isDraft
-          }
-        }
-      }
-    `,
-    { pullRequestId }
-  );
+async function convertToDraft(github, { owner, repo, pullNumber }) {
+  await github.rest.pulls.update({
+    owner,
+    repo,
+    pull_number: pullNumber,
+    draft: true,
+  });
 }
 
 module.exports = {

.github/scripts/revision-guard/index.js

@@ -18,7 +18,6 @@ module.exports = async function revisionGuard({ github, context, core }) {
     !repo?.repo ||
     !pr ||
     typeof pr.number !== 'number' ||
-    !pr.node_id ||
     reviewState !== 'changes_requested'
   ) {
     core?.info?.('Skipping revision guard due to missing or non-matching payload data.');
@@ -36,7 +35,11 @@ module.exports = async function revisionGuard({ github, context, core }) {
   }
 
   try {
-    await convertToDraft(github, pr.node_id);
+    await convertToDraft(github, {
+      owner: repo.owner,
+      repo: repo.repo,
+      pullNumber: pr.number,
+    });
     core?.info?.(`Converted PR #${pr.number} to draft.`);
   } catch (error) {
     core?.error?.(`Failed to convert PR #${pr.number} to draft: ${error.message}`);

.github/scripts/revision-guard/index.test.js

@@ -17,19 +17,22 @@ function freshRequire() {
 
 function createGithubMock() {
   const removedLabels = [];
+  const pullUpdates = [];
 
   return {
     removedLabels,
-    graphqlCalls: [],
-    graphql: async function (_query, variables) {
-      this.graphqlCalls.push(variables);
-    },
+    pullUpdates,
     rest: {
       issues: {
         removeLabel: async ({ name }) => {
           removedLabels.push(name);
         },
       },
+      pulls: {
+        update: async (params) => {
+          pullUpdates.push(params);
+        },
+      },
     },
   };
 }
@@ -71,7 +74,9 @@ describe('revision-guard index', () => {
 
     await handler({ github, context, core: { info() {} } });
 
-    assert.deepEqual(github.graphqlCalls, [{ pullRequestId: 'PR_node_42' }]);
+    assert.deepEqual(github.pullUpdates, [
+      { owner: 'hiero-ledger', repo: 'hiero-sdk-python', pull_number: 42, draft: true },
+    ]);
     assert.deepEqual(github.removedLabels, [
       'queue:committers',
       'status: ready-to-merge',
@@ -93,7 +98,7 @@ describe('revision-guard index', () => {
 
     await handler({ github, context, core: { info() {} } });
 
-    assert.equal(github.graphqlCalls.length, 0);
+    assert.equal(github.pullUpdates.length, 0);
     assert.equal(github.removedLabels.length, 0);
   });
 
@@ -112,7 +117,7 @@ describe('revision-guard index', () => {
 
     await handler({ github, context, core: { info() {} } });
 
-    assert.equal(github.graphqlCalls.length, 0);
+    assert.equal(github.pullUpdates.length, 0);
     assert.equal(github.removedLabels.length, 0);
   });
 
@@ -137,7 +142,9 @@ describe('revision-guard index', () => {
     await handler({ github, context, core: { info() {} } });
 
     // Draft conversion must also fire for configurable-label scenarios.
-    assert.deepEqual(github.graphqlCalls, [{ pullRequestId: 'PR_node_45' }]);
+    assert.deepEqual(github.pullUpdates, [
+      { owner: 'hiero-ledger', repo: 'hiero-sdk-python', pull_number: 45, draft: true },
+    ]);
     // Custom labels AND the matching default (queue:committers) must both be removed.
     assert.deepEqual(github.removedLabels, ['queue:committers', 'custom: one', 'custom: two']);
   });