ci: gate call-check-tflite-files behind approval-gate

[adilburaksen]

Summary

The call-check-tflite-files job in pr_test.yml was the only CI job that did not require [gatekeeper, approval-gate]. All other call-* jobs are gated, but this one ran unconditionally on every pull_request_target event.

Root Cause

check_tflite_files.yml checks out the PR's head.sha (i.e. fork code) and executes tensorflow/lite/micro/tools/ci_build/check_tflite_files.sh from that checkout — running untrusted contributor code in the base repository's workflow context with GITHUB_TOKEN exposed via the TFLM_BOT_TOKEN environment variable.

Fix

Add needs: [gatekeeper, approval-gate] to call-check-tflite-files to match all other CI jobs in this workflow.

Alternative (stronger fix)

check_tflite_files.yml does not need to execute any contributor-provided code at all. The PR file list can be fetched entirely via the GitHub API using the base repository's token, without checking out fork code. Consider refactoring to:

1. Checkout only the base branch (no ref: override)
2. Use curl -H "Authorization: Bearer $TFLM_BOT_TOKEN" .../pulls/$PR_NUMBER/files with the base repo's token

This would make the check safe to run ungated.

BUG=N/A

[adilburaksen]

Hi @veblush — gentle ping. Updated the PR description to add the BUG=N/A line so "Check Bug ID" should pass on the next sync. The change brings call-check-tflite-files in line with [gatekeeper, approval-gate], matching every other call-* job in pr_test.yml. Happy to adjust or split into the safer refactor described in the Alternative section if that's preferred. Thanks!

[adilburaksen]

Hi @veblush — pinging again in case this got lost in the queue.

This is a one-line security fix: call-check-tflite-files was the only ungated call-* job in pr_test.yml. Every other call-* job has needs: [gatekeeper, approval-gate], but this one ran unconditionally on pull_request_target events, executing fork code (head.sha checkout + check_tflite_files.sh) in the base repository's CI context with TFLM_BOT_TOKEN available.

The fix brings it in line with the existing gating pattern — no functional change to what the job does, just when it runs.

Happy to do the stronger refactor (API-only file list, no fork checkout) if that's preferred, but this minimal fix closes the immediate exposure. Thanks!