Harden review-trigger workflow: consistency and cost improvements #35431

Follow-up from PR #35250 review

Three low-priority hardening items identified during adversarial code review of the review-trigger workflow.

1. ⚠️ Move github.actor / github.repository to env: vars

File: .github/workflows/review-trigger.yml lines 53-54, 148, 178

${{ github.actor }} and ${{ github.repository }} are interpolated directly in shell via ${{ }}. The PR correctly hardened inputs.pr_number and comment body via env:, but missed these. Not exploitable today (GitHub usernames are [a-zA-Z0-9-]), but inconsistent with the hardening pattern.

Fix: Pass via env: block:

env:
  ACTOR: ${{ github.actor }}
  REPO: ${{ github.repository }}
run: |
  PERMISSION=$(gh api "repos/${REPO}/collaborators/${ACTOR}/permission" --jq .permission)

2. 💡 Combine OIDC + AzDO token exchange into single step

File: .github/workflows/review-trigger.yml lines 201-261

OIDC and AzDO tokens are masked but persisted to $GITHUB_OUTPUT between steps. Since the OIDC token is only needed to get the AzDO token, and the AzDO token is only needed to trigger the pipeline, all three operations could be combined into a single step — avoiding intermediate token storage.

3. ⚠️ Runner provisioned before permission check

File: .github/workflows/review-trigger.yml lines 33-59

The job-level if: checks comment body but not actor permission. Any user who comments /review spins up a runner before the permission step rejects them. Low individual cost but could be abused at scale.

Possible fix: Move permission check to a lightweight pre-job, or exit with exit 0 (not exit 1) on unauthorized users to avoid noisy failed runs.

Identified via multi-model adversarial code review (3 independent reviewers with consensus validation).