Enforce token-first GitHub access in issue and PR review skills

[terrymanu]

No description provided.

[terrymanu]

Result

Review Result: Mergeable

The code-scope review passes. No blocking issue satisfied the Finding Proof Gate. The PR correctly implements token-first GitHub access, private-repository 404 handling, and authorized evidence boundaries.

Evidence

• PR: #39486
• Reviewed head: 29c99d0cf26826f9a8f3a22ebaf41906e9330ca1
• Base: 38ca06cf9c73bad5e2be61d8d05f9b6091126b3f
• evidence-access.md:42: checks GH_TOKEN and GITHUB_TOKEN first, uses direct REST/GraphQL access when a token is available, and handles private-repository 404 responses correctly.
• review-pr/SKILL.md:117: requires access preflight before the first GitHub request.
• analyze-issue/SKILL.md:129: applies the same access contract to issue analysis.
• openai.yaml:21: keeps the agent prompt consistent with the Skill scope.

Coverage

• The authoritative GitHub file list matches the local base...head file list: 4 files reviewed.
• Behavior clusters:
  • GitHub authentication and private-repository access;
  • Review and Issue Skill execution order;
  • Authorized downstream-repository evidence boundaries;
  • Agent metadata.
• Root-cause, blast-radius, tests/runtime, and convergence passes were completed with no new findings.
• YAML, access-contract, and git diff --check validation passed.
• This was a Code Correctness Review; CI/Actions were not queried or evaluated.
• The PR has no description, comments, or review threads. The title, diff, and repository contracts were sufficient for the code-scope assessment.