fix(ci): restore trusted PR review dispatch

.github/workflows/ai-review.yml

@@ -15,6 +15,16 @@ on:
 concurrency:
   group: >-
     pr-agent-${{
+      github.event_name == 'workflow_dispatch' && format('dispatch-{0}', github.run_id) ||
+      (
+        github.event_name == 'issue_comment' && (
+          github.event.comment.body != '/review' ||
+          (
+            github.event.sender.type == 'Bot' &&
+            github.event.sender.login != 'github-actions[bot]'
+          )
+        )
+      ) && format('skip-{0}', github.run_id) ||
       github.event.pull_request.number ||
       github.event.issue.number ||
       github.event.inputs.pr_number ||
@@ -31,12 +41,19 @@ jobs:
       issues: write
 
     steps:
+      - name: Generate App Token
+        id: app-token
+        uses: actions/create-github-app-token@v1
+        with:
+          app-id: ${{ secrets.CCS_REVIEWER_APP_ID }}
+          private-key: ${{ secrets.CCS_REVIEWER_PRIVATE_KEY }}
+
       - name: Post /review command to the PR
         uses: actions/github-script@v7
         env:
           PR_NUMBER: ${{ github.event.inputs.pr_number }}
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ steps.app-token.outputs.token }}
           script: |
             const issue_number = Number(process.env.PR_NUMBER);
             if (!Number.isInteger(issue_number) || issue_number <= 0) {