[CFX-6498] fix(ci): validate fork smoke dispatch initiator permissions (#575)

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

Author: ajalon1

.github/workflows/comment-commands.yaml

@@ -113,6 +113,7 @@ jobs:
               ref: 'main',
               inputs: {
                 pr_number: context.issue.number.toString(),
+                approver: context.actor,
               }
             });
 

.github/workflows/fork-smoke-tests.yaml

@@ -14,6 +14,10 @@ on:
         description: 'Exact commit SHA from the fork PR to test (leave empty to use PR head)'
         required: false
         type: string
+      approver:
+        description: 'Username of maintainer approving this test. Auto-filled by CI (leave empty for manual runs)'
+        required: false
+        type: string
 
 jobs:
   check-permissions:
@@ -26,21 +30,24 @@ jobs:
         uses: actions/github-script@v9
         with:
           script: |
+            const approver = '${{ inputs.approver }}'.trim();
+            const actorToCheck = approver || context.actor;
+
             const result = await github.rest.repos.getCollaboratorPermissionLevel({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              username: context.actor,
+              username: actorToCheck,
             });
             const allowed = ['write', 'maintain', 'admin'];
             const permission = result.data.permission;
             if (!allowed.includes(permission)) {
               core.setFailed(
-                `@${context.actor} has permission '${permission}' — ` +
+                `@${actorToCheck} has permission '${permission}' — ` +
                 `maintainer access (write/maintain/admin) is required to run fork smoke tests.`
               );
               return;
             }
-            console.log(`@${context.actor} has permission '${permission}' — proceeding.`);
+            console.log(`@${actorToCheck} has permission '${permission}' — proceeding.`);
 
   resolve-pr:
     needs: [check-permissions]