fix: authenticate and reconcile approval delegations

.github/workflows/weighted-approval-review-event.yml

@@ -9,6 +9,7 @@ permissions: {}
 
 jobs:
   record-review-event:
+    if: github.event.pull_request.state == 'open'
     name: record weighted approval review event
     runs-on: ubuntu-latest
     timeout-minutes: 2

.github/workflows/weighted-approval.yml

@@ -20,7 +20,11 @@ concurrency:
 
 jobs:
   publish-status:
-    if: (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') && (github.event_name != 'issue_comment' || github.event.issue.pull_request)
+    if: >-
+      (github.event_name != 'pull_request_target' || github.event.pull_request.state == 'open') &&
+      (github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success') &&
+      (github.event_name != 'issue_comment' || (github.event.issue.pull_request && github.event.issue.state == 'open' &&
+        (contains(github.event.comment.body, '/delegate') || contains(github.event.changes.body.from, '/delegate'))))
     name: weighted approval publisher
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -39,20 +43,23 @@ jobs:
           GITHUB_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: node .github/review-ownership/check-approval.mjs pending
       # SECURITY: dependency setup runs in the status-writing job.
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - if: steps.revoke.outputs.active == 'true'
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.10'
           cache: pip
           cache-dependency-path: .github/review-ownership/requirements.txt
       - name: Install production lexer
+        if: steps.revoke.outputs.active == 'true'
         run: python3 -m pip install -r .github/review-ownership/requirements.txt
       - name: Publish weighted approval status
+        if: steps.revoke.outputs.active == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
           GITHUB_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: node .github/review-ownership/check-approval.mjs
       - name: Publish approval setup failure
-        if: failure() && steps.revoke.outcome == 'success'
+        if: failure() && steps.revoke.outputs.active == 'true'
         env:
           GITHUB_TOKEN: ${{ github.token }}
           GITHUB_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}