ci(system-file-changes): pass if author/actor is an admin

[caugner]

Description

Prevents the system-file-changes workflow from failing, if both PR author and actor are admin.

Motivation

Reduces noise when admins update system files, and reduces the chances of missing other failing workflows.

Additional details

Verified as follows:

• Temporarily added pull_request trigger, see: https://github.com/mdn/content/actions/runs/13838682590/job/38720221491
• Manually ran:

  AUTHOR="mdn-bot"
  AUTHOR_PERMISSION=$(gh api https://api.github.com/repos/mdn/content/collaborators/$AUTHOR/permission --jq .permission)
  
  if [ "$AUTHOR_PERMISSION" != "admin" ]; then
   echo "PR author ($AUTHOR) is not an admin, please ping someone for a review."
  fi
  # Output: PR author (mdn-bot) is not an admin, please ping someone for a review.

Related issues and pull requests

[Josh-Cena]

I don't see why this workflow is necessary in the first place. Currently infrastructure updates are mostly reviewed by either Brian or me and I'm not an admin. If you don't mark this workflow as required (like what we already do) then it only has the same security requirements as normal content PRs, just that I have to merge it with a red cross. If you do make it required, then it's just making those PRs move slower with an unclear benefit (status quo is "no protection" and you don't see anything going wrong). And currently this workflow blocks on non-"system" files as well, like vscode config, spell checker infra, etc., which is not going to do us a favor.

[caugner]

I don't see why this workflow is necessary in the first place.

The value of this workflow is that reveals very prominently if a PR changes system files, and drastically reduces the chances of accidental or intentional system file changes slipping through as part of a "regular" content PR.

In my opinion there are certain files that shouldn't be changed without admin involvement, so it's probably a good idea to make this workflow required.

However, there may be files that are currently classified as system files that don't require this scrutiny.

[caugner]

@bsmth found this issue which provides some more context.

[bsmth]

Seems solid to me, at least fewer red builds / checks are welcome