ci: add read-only PR review workflow

.github/workflows/pr-review.yml

@@ -0,0 +1,37 @@
+name: PR Review
+
+on:
+    pull_request_target:
+        branches: [main]
+        types: [opened, synchronize, reopened, edited]
+
+permissions:
+    contents: read
+    pull-requests: read
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    validate:
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  ref: ${{ github.event.pull_request.base.sha }}
+                  fetch-depth: 1
+                  persist-credentials: false
+            - uses: astral-sh/setup-uv@v6
+            - uses: actions/setup-python@v5
+              with:
+                  python-version: "3.11"
+            - name: Install dependencies
+              run: uv sync --frozen --no-install-project
+            - name: Review pull request
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+                  GITHUB_REPOSITORY: ${{ github.repository }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+              run: uv run python scripts/review_pr.py

tests/test_pr_review_workflow.py

@@ -0,0 +1,55 @@
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+WORKFLOW_PATH = ROOT / ".github" / "workflows" / "pr-review.yml"
+EXPECTED_WORKFLOW = """name: PR Review
+
+on:
+    pull_request_target:
+        branches: [main]
+        types: [opened, synchronize, reopened, edited]
+
+permissions:
+    contents: read
+    pull-requests: read
+
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    validate:
+        runs-on: ubuntu-latest
+        timeout-minutes: 10
+        steps:
+            - uses: actions/checkout@v4
+              with:
+                  ref: ${{ github.event.pull_request.base.sha }}
+                  fetch-depth: 1
+                  persist-credentials: false
+            - uses: astral-sh/setup-uv@v6
+            - uses: actions/setup-python@v5
+              with:
+                  python-version: "3.11"
+            - name: Install dependencies
+              run: uv sync --frozen --no-install-project
+            - name: Review pull request
+              env:
+                  GITHUB_TOKEN: ${{ github.token }}
+                  GITHUB_REPOSITORY: ${{ github.repository }}
+                  PR_NUMBER: ${{ github.event.pull_request.number }}
+              run: uv run python scripts/review_pr.py
+"""
+
+
+class PullRequestReviewWorkflowContractTests(unittest.TestCase):
+    def test_matches_the_complete_read_only_security_contract(self):
+        workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
+
+        self.assertEqual(workflow, EXPECTED_WORKFLOW)
+
+
+if __name__ == "__main__":
+    unittest.main()