Run security-guard only when PR is marked ready for review

[Copilot]

The security-guard workflow was running on all PRs including drafts, creating noise before code is ready for review.

Changes

• Added draft: false filter to pull_request trigger in security-guard.md
• Set trigger to only ready_for_review event (removed opened, synchronize, reopened)
• Recompiled workflow with draft filtering conditions applied to job gates

Implementation

on:
  pull_request:
    types: [ready_for_review]
    draft: false

The compiler transforms this into job-level conditions (github.event.pull_request.draft == false) on both pre_activation and activation jobs, following the existing pattern used by other workflows in the repo.

Result

Security reviews now only run when a PR is explicitly marked as ready for review. The workflow will not run on initial PR creation, subsequent pushes, or reopened PRs - only when the author marks the PR ready for review.

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

Original prompt

Update security guard to only run when the pull request is ready for review.

Custom agent used: agentic-workflows
GitHub Agentic Workflows (gh-aw) - Create, debug, and upgrade AI-powered workflows with intelligent prompt routing

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.