ci: run the AI review from Kong/volcano-actions (#393)

* ci: add the Claude review from Kong/volcano-actions

* ci: pass the OpenAI key to the combined review

* ci: rename the review stubs to ai-review

* ci(review): run Codex with the ChatGPT access token

Author: swkeever

.github/workflows/ai-review-approvals.yml

@@ -0,0 +1,16 @@
+name: AI Review (approvals)
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions: {}
+
+jobs:
+  # A review runs the PR's own copy of this workflow, so it only finishes;
+  # AI Review (human gate) then runs from the default branch.
+  reviewed:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - run: echo "AI Review (human gate) re-sets ai-review/human."

.github/workflows/ai-review-human.yml

@@ -0,0 +1,20 @@
+name: AI Review (human gate)
+
+on:
+  workflow_run:
+    workflows: [AI Review (approvals)]
+    types: [completed]
+  pull_request_target:
+    branches: [main]
+    types: [labeled, unlabeled]
+
+permissions: {}
+
+jobs:
+  human-gate:
+    if: github.event_name == 'workflow_run' || github.event.label.name == 'needs-human-review'
+    uses: Kong/volcano-actions/.github/workflows/ai-review-human.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write

.github/workflows/ai-review-merge-queue.yml

@@ -0,0 +1,14 @@
+name: AI Review (merge queue)
+
+on:
+  merge_group:
+    branches: [main]
+    types: [checks_requested]
+
+permissions: {}
+
+jobs:
+  pass:
+    uses: Kong/volcano-actions/.github/workflows/ai-review-merge-queue.yml@main
+    permissions:
+      statuses: write

.github/workflows/ai-review-retarget-override.yml

@@ -0,0 +1,20 @@
+name: AI Review (retarget and override)
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [edited, labeled]
+
+permissions: {}
+
+jobs:
+  retarget-or-override:
+    if: github.event.changes.base || github.event.label.name == 'ai-review-override'
+    uses: Kong/volcano-actions/.github/workflows/ai-review.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    secrets:
+      anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
+      codex_access_token: ${{ secrets.CODEX_CI_ACCESS_TOKEN }}

.github/workflows/ai-review.yml

@@ -0,0 +1,19 @@
+name: AI Review
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions: {}
+
+jobs:
+  ai-review:
+    uses: Kong/volcano-actions/.github/workflows/ai-review.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    secrets:
+      anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
+      codex_access_token: ${{ secrets.CODEX_CI_ACCESS_TOKEN }}