fix: move CodeRabbit plan trigger to approved-issues workflow and simplify skill-label trigger

Signed-off-by: Anshul Kushwaha <137977998+sudo-anshul@users.noreply.github.com>

Author: sudo-anshul

.github/scripts/coderabbit_plan_trigger.js

@@ -97,6 +97,10 @@ async function main({ github, context }) {
     // Validations
     if (!issue?.number) return console.log('No issue in payload');
 
+    if (issue.locked) {
+      return console.log(`Issue #${issue.number} is locked. CodeRabbit plan trigger will be deferred until the issue is approved and unlocked.`);
+    }
+
     if (!hasBeginnerOrHigherLabel(issue, label)) {
       return console.log('Issue does not have beginner/intermediate/advanced label');
     }

.github/workflows/approved-issues.yml

@@ -13,6 +13,7 @@ defaults:
 
 permissions:
   issues: write
+  contents: read
 
 concurrency:
   group: approve-issues-${{ github.event.issue.number }}
@@ -50,3 +51,17 @@ jobs:
           issue-number: ${{ github.event.issue.number }}
           body: |
             Approved by @hiero-ledger/hiero-sdk-python-triage and @hiero-ledger/hiero-sdk-python-committers and @hiero-ledger/hiero-sdk-python-maintainers.
+
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Trigger CodeRabbit Plan
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const script = require('./.github/scripts/coderabbit_plan_trigger.js');
+            await script({ github, context });

.github/workflows/bot-coderabbit-plan-trigger.yml

@@ -1,10 +1,9 @@
 # Triggers CodeRabbit's plan feature for difficulty-labeled issues.
-# It runs when a difficulty label is added to an unlocked issue, and again when
-# a previously locked issue is unlocked (e.g. after triage approval).
+# It runs when a difficulty label is added to an unlocked issue.
 name: CodeRabbit Plan Trigger
 on:
   issues:
-    types: [labeled, unlocked]
+    types: [labeled]
 
 permissions:
   issues: write
@@ -16,50 +15,24 @@ jobs:
     concurrency:
       group: coderabbit-plan-${{ github.event.issue.number }}
       cancel-in-progress: false
+    # Run only for open, unlocked issues when a difficulty label is added.
+    if: >
+      github.event.issue.state == 'open' &&
+      github.event.issue.locked == false &&
+      contains(fromJson('["skill: beginner","skill: intermediate","skill: advanced"]'), github.event.label.name)
 
     steps:
       - name: Harden the runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           egress-policy: audit
 
-      - name: Evaluate trigger conditions
-        id: should_run
-        run: echo "value=true" >> "$GITHUB_OUTPUT"
-        # Run only for open, unlocked issues that have beginner/intermediate/advanced difficulty.
-        if: >
-          github.event.issue.state == 'open' &&
-          github.event.issue.locked == false &&
-          (
-            (
-              github.event.action == 'labeled' &&
-              contains(fromJson('["skill: beginner","skill: intermediate","skill: advanced"]'), github.event.label.name)
-            ) ||
-            (
-              github.event.action == 'unlocked' &&
-              (
-                contains(github.event.issue.labels.*.name, 'skill: beginner') ||
-                contains(github.event.issue.labels.*.name, 'skill: intermediate') ||
-                contains(github.event.issue.labels.*.name, 'skill: advanced')
-              )
-            )
-          )
-
-      - name: Log skip context
-        if: steps.should_run.outputs.value != 'true'
-        run: |
-          echo "::notice::Skipping CodeRabbit plan trigger"
-          echo "::notice::action=${{ github.event.action }}"
-          echo "::notice::issue_state=${{ github.event.issue.state }}"
-          echo "::notice::issue_locked=${{ github.event.issue.locked }}"
-          echo "::notice::issue_labels=${{ join(github.event.issue.labels.*.name, ', ') }}"
-
       - name: Checkout repository
-        if: steps.should_run.outputs.value == 'true'
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Trigger CodeRabbit Plan
-        if: steps.should_run.outputs.value == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #v9.0.0