fix: address review feedback on revision-guard draft conversion flow

- fix: add defensive guard on context.payload and context.repo before
  dereferencing (CodeRabbit major)
- fix: parseManagedLabels now merges custom labels with DEFAULT_MANAGED_LABELS
  instead of silently discarding defaults (darshit2308 blocking)
- test: add graphqlCalls assertion in configurable-labels test to catch
  draft-conversion regressions (CodeRabbit trivial)
- fix: checkout uses trusted base SHA instead of PR head/merge ref to
  prevent fork PRs from running untrusted code with write-scoped token
  (CodeRabbit critical)

Signed-off-by: Gourav NSS <gourav341111@gmail.com>

Author: NssGourav

.github/scripts/revision-guard/helpers/constants.js

@@ -12,10 +12,15 @@ function parseManagedLabels(value) {
     return [...DEFAULT_MANAGED_LABELS];
   }
 
-  return value
+  const customLabels = value
     .split(',')
     .map(label => label.trim())
     .filter(Boolean);
+
+  // Merge custom labels with defaults so that setting REVISION_GUARD_MANAGED_LABELS
+  // adds to the managed set rather than silently discarding the default labels.
+  const merged = new Set([...DEFAULT_MANAGED_LABELS, ...customLabels]);
+  return [...merged];
 }
 
 module.exports = {

.github/scripts/revision-guard/index.js

@@ -7,10 +7,21 @@ const {
 } = require('./helpers');
 
 module.exports = async function revisionGuard({ github, context, core }) {
-  const reviewState = context.payload.review?.state;
-  const pr = context.payload.pull_request;
+  const payload = context?.payload;
+  const repo = context?.repo;
+  const reviewState = payload?.review?.state;
+  const pr = payload?.pull_request;
 
-  if (!pr || reviewState !== 'changes_requested') {
+  if (
+    !payload ||
+    !repo?.owner ||
+    !repo?.repo ||
+    !pr ||
+    typeof pr.number !== 'number' ||
+    !pr.node_id ||
+    reviewState !== 'changes_requested'
+  ) {
+    core?.info?.('Skipping revision guard due to missing or non-matching payload data.');
     return;
   }
 
@@ -34,8 +45,8 @@ module.exports = async function revisionGuard({ github, context, core }) {
   }
 
   await removeManagedLabels(github, {
-    owner: context.repo.owner,
-    repo: context.repo.repo,
+    owner: repo.owner,
+    repo: repo.repo,
     issueNumber: pr.number,
     labels: labelsToRemove,
   });

.github/scripts/revision-guard/index.test.js

@@ -116,7 +116,7 @@ describe('revision-guard index', () => {
     assert.equal(github.removedLabels.length, 0);
   });
 
-  it('uses configurable managed labels', async () => {
+  it('uses configurable managed labels and still removes defaults', async () => {
     process.env.REVISION_GUARD_MANAGED_LABELS = 'custom: one, custom: two';
     const handler = freshRequire();
     const github = createGithubMock();
@@ -136,6 +136,9 @@ describe('revision-guard index', () => {
 
     await handler({ github, context, core: { info() {} } });
 
-    assert.deepEqual(github.removedLabels, ['custom: one', 'custom: two']);
+    // Draft conversion must also fire for configurable-label scenarios.
+    assert.deepEqual(github.graphqlCalls, [{ pullRequestId: 'PR_node_45' }]);
+    // Custom labels AND the matching default (queue:committers) must both be removed.
+    assert.deepEqual(github.removedLabels, ['queue:committers', 'custom: one', 'custom: two']);
   });
 });

.github/workflows/revision-guard.yml

@@ -27,6 +27,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          # Use trusted base commit, not PR head/merge ref, to prevent fork PRs
+          # from executing untrusted changes with a write-scoped token.
+          ref: ${{ github.event.pull_request.base.sha }}
           sparse-checkout: .github/scripts
 
       - name: Handle changes requested