Fix eval workflows

[JanKrivanek]

Motivation

Fixing the trigger and limits for eval pipelines from
#1195

[Copilot]

Pull request overview

Adjusts the skill evaluation workflows introduced in PR #1195 by fixing the PR trigger behavior for the PR-gate validator and preventing nightly report creation from failing due to GitHub body-size limits.

Changes:

• Update the PR-gate workflow to run on pull_request_target and explicitly checkout the PR head SHA.
• Add report body truncation logic to keep Skill Quality Report discussions/issues under GitHub’s body limit.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/skill-check.yml	Changes trigger to pull_request_target and checks out PR head SHA to run validation and post PR comments.
.github/workflows/skill-quality-report.yml	Truncates generated report body before posting to Discussion/Issue to avoid exceeding GitHub limits.

Comments suppressed due to low confidence (1)

.github/workflows/skill-check.yml:26

• Because this workflow checks out untrusted PR code (head SHA) under pull_request_target, any later shell execution that incorporates repo-controlled paths/content becomes high-risk. In this job, the validator command is assembled from git diff-derived paths and executed as a shell string, which can be vulnerable to command injection with crafted filenames. If you keep pull_request_target, ensure subsequent steps build commands using argument arrays / proper quoting (avoid executing concatenated strings) and consider persist-credentials: false on checkout to further reduce token exposure.

      - name: Checkout PR code
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0