fix: validate payload before writing artifact; replace continue-on-error with explicit pre-check

- capture-pr-review.yml: validate reviewer login and PR number before
  writing the artifact; throw with a clear message if the payload is
  malformed so the capture job fails visibly instead of publishing a
  bad artifact downstream
- on-review.yml: remove continue-on-error on the download step;
  add an explicit artifact pre-check step that lists artifacts for the
  triggering run and sets an output; all subsequent steps gate on that
  output so a missing artifact (bot actor skip) is logged as a notice
  and the job exits cleanly, while an unexpected download failure now
  surfaces as a proper job failure

Signed-off-by: Mounil Kanakhara <mounilkankhara@gmail.com>

Author: Mounil2005

.github/workflows/capture-pr-review.yml

@@ -25,10 +25,18 @@ jobs:
         with:
           script: |
             const fs = require('fs');
+            const reviewer = context.payload.review?.user?.login;
+            const prNumber = context.payload.pull_request?.number;
+            if (
+              typeof reviewer !== 'string' ||
+              reviewer.length === 0 ||
+              !Number.isInteger(prNumber) ||
+              prNumber <= 0
+            ) {
+              throw new Error(`Invalid pull_request_review payload: reviewer=${reviewer}, pr_number=${prNumber}`);
+            }
             fs.mkdirSync('review-data', { recursive: true });
-            const reviewer = context.payload.review?.user?.login ?? null;
-            const pr_number = context.payload.pull_request?.number ?? null;
-            fs.writeFileSync('review-data/review.json', JSON.stringify({ reviewer, pr_number }));
+            fs.writeFileSync('review-data/review.json', JSON.stringify({ reviewer, pr_number: prNumber }));
 
       - name: Upload review metadata
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/on-review.yml

@@ -69,23 +69,37 @@ jobs:
         with:
           egress-policy: audit
 
+      - name: Check for review artifact
+        id: check
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const name = `review-data-${context.payload.workflow_run.id}`;
+            const { data } = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id
+            });
+            const found = data.artifacts.some(a => a.name === name && !a.expired);
+            if (!found) core.notice('Review artifact not found; capture job was likely skipped for a bot actor. Nothing to do.');
+            core.setOutput('found', String(found));
+
       - name: Download review metadata
-        id: download
+        if: steps.check.outputs.found == 'true'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: review-data-${{ github.event.workflow_run.id }}
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
-        continue-on-error: true
 
       - name: Checkout repository
-        if: steps.download.outcome == 'success'
+        if: steps.check.outputs.found == 'true'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       - name: Run Remove Reviewer from Assignees
-        if: steps.download.outcome == 'success'
+        if: steps.check.outputs.found == 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |