[SergeyMenshykh]

Motivation and Context

DevFlow currently starts PR reviews for all contributors. Align its review eligibility with Microsoft Agent Framework by checking membership in the internal developer team before running the review.

Description

• Split the workflow into prepare_pr, team_check, and review jobs. The review runs only when the team check succeeds.
• Check the PR author for automatic runs and the person starting the workflow for manual runs. Draft PRs follow the same eligibility check as other PRs.
• Add a team-membership helper that uses the team slug supplied by DEVELOPER_TEAM, plus a team-check GitHub App token profile with member and PR read permissions.
• Keep SK's existing spam/relevance check and DevFlow review steps.
• Add tests for the membership helper and token profile, and include the helper in the automation test workflow's path filters.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The security-sensitive gate still has excess permissions, and its live team and App configuration needs human validation.

Review effort: Balanced
Findings: 1

Open (1)

• Limit team_check permissions to only required access · New

What changed in this PR

This PR limits DevFlow pull request reviews to internal contributors while keeping the existing relevance check and review steps.

Changes:

• Split review preparation, team eligibility, and review into separate jobs.
• Add a team-membership helper and a read-only GitHub App token profile.
• Add tests and update the automation test workflow’s path filters.

File	Description
.github/​workflows/​github-automation-tests.yml	Runs tests when the membership helper changes.
.github/​workflows/​devflow-pr-review.yml	Gates reviews on team membership.
.github/​tests/​test_create_github_app_token.js	Tests the new token permissions.
.github/​tests/​test_check_team_membership.js	Tests eligibility behavior.
.github/​scripts/​check_team_membership.js	Checks team membership.
.github/​actions/​github-app-token/​create-token.js	Adds the team-check permission profile.
.github/​actions/​github-app-token/​action.yml	Documents the new profile input.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.