When triggered by pull_request_review events, github.event.pull_request
is undefined, which can cause issues when the job tries to access
github.event.pull_request.number. Add a job-level if guard to prevent
the job from running in these conditions.
This addresses the dual approval failures seen on feature branches where
the workflow was running without a valid PR context.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Calls the shared privilegedescalation/.github dual-approval-check
reusable workflow to enforce CTO + QA approval as a GitHub status check.
Once privilegedescalation/.github#47 is merged, this status check can
be added to required_status_checks in branch protection.
Co-Authored-By: Paperclip <noreply@paperclip.ing>