[snake14]

Description

The vendored dependencies update now labels its pull request Needs Review and requests review from the organisation's plugin reviewer team, so an update pull request no longer sits unnoticed until someone goes looking for it.

The team is plugin-reviewers in matomo-org and premium-plugins-reviewers in innocraft, and a new reviewer-team input overrides it. Review is requested only while nobody is requested and nobody has reviewed, so the weekly refresh does not notify a team that is already reviewing, and a request GitHub refuses is retried on the next refresh. A refused request fails the run with GitHub's reason. Without DEPS_PR_TOKEN, or in an organisation with no known team, no review is requested and the run warns when the pull request is opened.

The request is made with DEPS_PR_TOKEN, so that token now needs to be able to request a team review as well as push and open the pull request. The README and the secret's description say so.

The weekly release workflow does the same for its release date pull request, but only when that pull request waits on a person: left open, or set to auto-merge but held by a required review or requested changes. A release that merges itself notifies nobody. The label is added with the workflow's token and review is requested with approver-token; without that token the pull request is labelled and the run warns. plugin-dev-release.yml gets the same reviewer-team input.

Issue No

N/A

Steps to Replicate the Issue

1. Let the scheduled vendored dependencies update open a pull request, eg Update scoped dependencies (6.x-dev) plugin-ApiReference#82.
2. Expected: the pull request is labelled for review and the plugin reviewers are asked to review it.
3. Actual: it has no label and no reviewer.

Checklist

• [✔] Tested locally or on demo2/demo3?
• [✔] New test case added/updated?
• [NA] Are all newly added texts included via translation?
• [NA] Are text sanitized properly? (Eg use of v-text v/s v-html for vue)
• [NA] Version bumped?
• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules
• [✔] Documentation updated?