chore(workflows): align issue label and preview gating (#12385)

* ci(workflows): align issue label and preview gating

Replace the legacy issue workflow with the org-level PF team label caller,
and gate PR preview deploys behind the reusable team-membership check.

Made-with: Cursor

* ci(workflows): run permission check for workflow_call

Remove the caller-level condition on check-permissions so workflow_call
runs are not skipped through dependency status.

Made-with: Cursor

* ci(workflows): pin org reusable workflows to SHA

Use patternfly/.github@fdb52a6 for
add-pf-team-label and check-team-membership callers.

Made-with: Cursor

Author: nicolethoen

.github/workflows/add-new-issues-to-project.yml

@@ -1,6 +1,8 @@
 name: Documentation
 on:
   pull_request_target:
+  issue_comment:
+    types: [created]
   workflow_call:
     secrets:
       SURGE_LOGIN:
@@ -10,25 +12,31 @@ on:
       GH_PR_TOKEN:
         required: true
 jobs:
+  check-permissions:
+    uses: patternfly/.github/.github/workflows/check-team-membership.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06
+    secrets: inherit
+
   deploy:
     name: Build, test & deploy
     runs-on: ubuntu-latest
+    needs: check-permissions
+    if: github.event_name == 'workflow_call' || needs.check-permissions.outputs.allowed == 'true'
     env:
       SURGE_LOGIN: ${{ secrets.SURGE_LOGIN }}
       SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
       GH_PR_TOKEN: ${{ secrets.GH_PR_TOKEN }}
-      GH_PR_NUM: ${{ github.event.number }}
+      GH_PR_NUM: ${{ needs.check-permissions.outputs.pr-number }}
     steps:
       - name: Check out project from PR branch
-        if: github.event_name == 'pull_request_target'
+        if: github.event_name == 'pull_request_target' || github.event_name == 'issue_comment'
         uses: actions/checkout@v4
         with:
           # Checkout the merge commit so that we can access the PR's changes.
           # This is nessesary because `pull_request_target` checks out the base branch (e.g. `main`) by default.
           ref: refs/pull/${{ env.GH_PR_NUM }}/head
 
       - name: Check out project
-        if: github.event_name != 'pull_request_target'
+        if: github.event_name == 'workflow_call'
         uses: actions/checkout@v4
 
       - name: Set up and build project

.github/workflows/documentation.yml

@@ -0,0 +1,9 @@
+name: Label PF Team issues
+on:
+  issues:
+    types:
+      - opened
+jobs:
+  label:
+    uses: patternfly/.github/.github/workflows/add-pf-team-label-workflow.yml@fdb52a63a2220ec8a3b6c2d43f312cda708ffa06
+    secrets: inherit