chore: update governance to use workflow_run for review events (#50)

* chore: update governance to use workflow_run for review events

This avoids missing secret issues when running governance checks on PRs from forks.

* chore: pass pr-number and commit-sha to reusable governance workflow

* chore: update governance workflow to let central repo resolve PR number from SHA

Author: damaz91

.github/workflows/governance.yml

@@ -13,21 +13,23 @@ on:
       assigned, 
       unassigned
     ]
-  pull_request_review:
-    types: [submitted, dismissed]
+  workflow_run:
+    workflows: ["PR Review Listener"]
+    types: [completed]
 
 jobs:
   governance:
     name: Reviews
-    # skip for draft PRs
-    if: github.event.pull_request.draft == false
     permissions:
       statuses: write
       contents: read
       pull-requests: read
     # Use the reusable workflow defined in the central governance repository
     # zizmor: ignore[ref-confusion]
     uses: Universal-Commerce-Protocol/.github/.github/workflows/reusable-governance.yml@main
+    with:
+      pr-number: ${{ github.event.pull_request.number }}
+      commit-sha: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
     secrets:
       # Required: An org-level Read token to read team memberships
       ORG_READ_TOKEN: ${{ secrets.ORG_READ_TOKEN }}

.github/workflows/pr-review-listener.yml

@@ -0,0 +1,12 @@
+name: PR Review Listener
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+jobs:
+  signal:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Signal success
+        run: |
+          echo "PR ${{ github.event.pull_request.number }} review state changed."