fix(review): key fork-guard bypass on event name

GitHub documents the pull_request payload as empty for fork PRs, so
!github.event.pull_request also admitted forks. Bypass only for
non-pull_request events, the smoke run on push to main.

Author: zfarrell

.github/workflows/claude-pr-review.yml

@@ -42,11 +42,12 @@ jobs:
     # Fork pull requests run without secrets, so the App token step would fail on an empty
     # private key before any review. Skip them rather than fail every outside contribution.
     # Compared by name, not head.repo.fork, which is also true for same-repo branches in a repo
-    # that is itself a fork. No pull request means the smoke run on push to main, which must
-    # still run.
+    # that is itself a fork. A non-pull_request event is the smoke run on push to main, which
+    # must still run; keyed on the event name because a fork's payload is documented as empty,
+    # so testing for an absent payload would let forks through.
     if: >-
       github.event.pull_request.draft == false &&
-      (!github.event.pull_request ||
+      (github.event_name != 'pull_request' ||
        github.event.pull_request.head.repo.full_name == github.repository)
     runs-on: ubuntu-latest
     timeout-minutes: 15

tests/workflow-lint-test.sh

@@ -225,7 +225,9 @@ fi
 #     Comparing the head repo's full name to this repo is the question actually being asked.
 #   - tests.yml runs this workflow on push to main, where there is no pull request and the head
 #     repo expands to null. A bare comparison is then false and the smoke job silently skips on
-#     main, so the guard must let a run without a pull request through.
+#     main, so the guard must let a run without a pull request through -- keyed on the event
+#     name, not on the payload being absent, because GitHub documents the pull_request payload
+#     as empty for fork pull requests, and `!github.event.pull_request` would wave those in.
 job_gate=$(awk '/^  review:$/ { found = 1; next }
                 found && /^    if:/ { print; in_if = 1; next }
                 in_if && /^      / { print; next }
@@ -238,7 +240,12 @@ elif ! printf '%s\n' "$job_gate" | grep -qF 'github.event.pull_request.head.repo
   echo "     and fail at the App token step:"
   printf '%s\n' "$job_gate" | sed 's/^/       /'
   failures=$((failures + 1))
-elif ! printf '%s\n' "$job_gate" | grep -qF '!github.event.pull_request ||'; then
+elif printf '%s\n' "$job_gate" | grep -qF '!github.event.pull_request'; then
+  echo "FAIL the review job's no-PR bypass tests for an absent payload, which is also true of a"
+  echo "     fork pull request's documented empty payload, so forks reach the App token step:"
+  printf '%s\n' "$job_gate" | sed 's/^/       /'
+  failures=$((failures + 1))
+elif ! printf '%s\n' "$job_gate" | grep -qF "github.event_name != 'pull_request' ||"; then
   echo "FAIL the review job's fork guard is not bypassed when there is no pull request, so the"
   echo "     smoke run on push to main skips instead of proving the workflow starts:"
   printf '%s\n' "$job_gate" | sed 's/^/       /'