From e833c302409a584acd925b6a1f8dfe9a231885df Mon Sep 17 00:00:00 2001
From: Sean Keever <33592180+swkeever@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:43:27 -0400
Subject: [PATCH 1/4] ci: add the Claude review from Kong/volcano-actions

---
 .github/workflows/claude-review-approvals.yml | 16 +++++++++++++++
 .github/workflows/claude-review-human.yml     | 20 +++++++++++++++++++
 .../workflows/claude-review-merge-queue.yml   | 14 +++++++++++++
 .../claude-review-retarget-override.yml       | 19 ++++++++++++++++++
 .github/workflows/claude-review.yml           | 18 +++++++++++++++++
 5 files changed, 87 insertions(+)
 create mode 100644 .github/workflows/claude-review-approvals.yml
 create mode 100644 .github/workflows/claude-review-human.yml
 create mode 100644 .github/workflows/claude-review-merge-queue.yml
 create mode 100644 .github/workflows/claude-review-retarget-override.yml
 create mode 100644 .github/workflows/claude-review.yml

diff --git a/.github/workflows/claude-review-approvals.yml b/.github/workflows/claude-review-approvals.yml
new file mode 100644
index 00000000..5d27ec1b
--- /dev/null
+++ b/.github/workflows/claude-review-approvals.yml
@@ -0,0 +1,16 @@
+name: Claude Review (approvals)
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions: {}
+
+jobs:
+  # A review runs the PR's own copy of this workflow, so it only finishes;
+  # Claude Review (human gate) then runs from the default branch.
+  reviewed:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - run: echo "Claude Review (human gate) re-sets claude-review/human."
diff --git a/.github/workflows/claude-review-human.yml b/.github/workflows/claude-review-human.yml
new file mode 100644
index 00000000..272e312d
--- /dev/null
+++ b/.github/workflows/claude-review-human.yml
@@ -0,0 +1,20 @@
+name: Claude Review (human gate)
+
+on:
+  workflow_run:
+    workflows: [Claude Review (approvals)]
+    types: [completed]
+  pull_request_target:
+    branches: [main]
+    types: [labeled, unlabeled]
+
+permissions: {}
+
+jobs:
+  human-gate:
+    if: github.event_name == 'workflow_run' || github.event.label.name == 'needs-human-review'
+    uses: Kong/volcano-actions/.github/workflows/claude-review-human.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
diff --git a/.github/workflows/claude-review-merge-queue.yml b/.github/workflows/claude-review-merge-queue.yml
new file mode 100644
index 00000000..f76337f9
--- /dev/null
+++ b/.github/workflows/claude-review-merge-queue.yml
@@ -0,0 +1,14 @@
+name: Claude Review (merge queue)
+
+on:
+  merge_group:
+    branches: [main]
+    types: [checks_requested]
+
+permissions: {}
+
+jobs:
+  pass:
+    uses: Kong/volcano-actions/.github/workflows/claude-review-merge-queue.yml@main
+    permissions:
+      statuses: write
diff --git a/.github/workflows/claude-review-retarget-override.yml b/.github/workflows/claude-review-retarget-override.yml
new file mode 100644
index 00000000..358d654b
--- /dev/null
+++ b/.github/workflows/claude-review-retarget-override.yml
@@ -0,0 +1,19 @@
+name: Claude Review (retarget and override)
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [edited, labeled]
+
+permissions: {}
+
+jobs:
+  retarget-or-override:
+    if: github.event.changes.base || github.event.label.name == 'claude-review-override'
+    uses: Kong/volcano-actions/.github/workflows/claude-review.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    secrets:
+      anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
new file mode 100644
index 00000000..2527165a
--- /dev/null
+++ b/.github/workflows/claude-review.yml
@@ -0,0 +1,18 @@
+name: Claude Review
+
+on:
+  pull_request_target:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions: {}
+
+jobs:
+  claude-review:
+    uses: Kong/volcano-actions/.github/workflows/claude-review.yml@main
+    permissions:
+      contents: read
+      pull-requests: write
+      statuses: write
+    secrets:
+      anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}

From be3f683d03b0de64ec5a495f50ffc761e35a6af9 Mon Sep 17 00:00:00 2001
From: Sean Keever <33592180+swkeever@users.noreply.github.com>
Date: Wed, 14 Oct 2026 15:23:36 -0400
Subject: [PATCH 2/4] ci: pass the OpenAI key to the combined review

---
 .github/workflows/claude-review-retarget-override.yml | 1 +
 .github/workflows/claude-review.yml                   | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.github/workflows/claude-review-retarget-override.yml b/.github/workflows/claude-review-retarget-override.yml
index 358d654b..bd589a45 100644
--- a/.github/workflows/claude-review-retarget-override.yml
+++ b/.github/workflows/claude-review-retarget-override.yml
@@ -17,3 +17,4 @@ jobs:
       statuses: write
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
+      openai_api_key: ${{ secrets.OPENAI_CI_API_KEY }}
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 2527165a..0c4c552c 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -16,3 +16,4 @@ jobs:
       statuses: write
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
+      openai_api_key: ${{ secrets.OPENAI_CI_API_KEY }}

From ba0e27efbdf32fdf391c52f78268dbbf1e528a76 Mon Sep 17 00:00:00 2001
From: Sean Keever <33592180+swkeever@users.noreply.github.com>
Date: Wed, 14 Oct 2026 16:08:19 -0400
Subject: [PATCH 3/4] ci: rename the review stubs to ai-review

---
 ...{claude-review-approvals.yml => ai-review-approvals.yml} | 6 +++---
 .../{claude-review-human.yml => ai-review-human.yml}        | 6 +++---
 ...ude-review-merge-queue.yml => ai-review-merge-queue.yml} | 4 ++--
 ...etarget-override.yml => ai-review-retarget-override.yml} | 6 +++---
 .github/workflows/{claude-review.yml => ai-review.yml}      | 6 +++---
 5 files changed, 14 insertions(+), 14 deletions(-)
 rename .github/workflows/{claude-review-approvals.yml => ai-review-approvals.yml} (57%)
 rename .github/workflows/{claude-review-human.yml => ai-review-human.yml} (68%)
 rename .github/workflows/{claude-review-merge-queue.yml => ai-review-merge-queue.yml} (54%)
 rename .github/workflows/{claude-review-retarget-override.yml => ai-review-retarget-override.yml} (74%)
 rename .github/workflows/{claude-review.yml => ai-review.yml} (76%)

diff --git a/.github/workflows/claude-review-approvals.yml b/.github/workflows/ai-review-approvals.yml
similarity index 57%
rename from .github/workflows/claude-review-approvals.yml
rename to .github/workflows/ai-review-approvals.yml
index 5d27ec1b..2415bf2e 100644
--- a/.github/workflows/claude-review-approvals.yml
+++ b/.github/workflows/ai-review-approvals.yml
@@ -1,4 +1,4 @@
-name: Claude Review (approvals)
+name: AI Review (approvals)
 
 on:
   pull_request_review:
@@ -8,9 +8,9 @@ permissions: {}
 
 jobs:
   # A review runs the PR's own copy of this workflow, so it only finishes;
-  # Claude Review (human gate) then runs from the default branch.
+  # AI Review (human gate) then runs from the default branch.
   reviewed:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - run: echo "Claude Review (human gate) re-sets claude-review/human."
+      - run: echo "AI Review (human gate) re-sets ai-review/human."
diff --git a/.github/workflows/claude-review-human.yml b/.github/workflows/ai-review-human.yml
similarity index 68%
rename from .github/workflows/claude-review-human.yml
rename to .github/workflows/ai-review-human.yml
index 272e312d..67fef1b2 100644
--- a/.github/workflows/claude-review-human.yml
+++ b/.github/workflows/ai-review-human.yml
@@ -1,8 +1,8 @@
-name: Claude Review (human gate)
+name: AI Review (human gate)
 
 on:
   workflow_run:
-    workflows: [Claude Review (approvals)]
+    workflows: [AI Review (approvals)]
     types: [completed]
   pull_request_target:
     branches: [main]
@@ -13,7 +13,7 @@ permissions: {}
 jobs:
   human-gate:
     if: github.event_name == 'workflow_run' || github.event.label.name == 'needs-human-review'
-    uses: Kong/volcano-actions/.github/workflows/claude-review-human.yml@main
+    uses: Kong/volcano-actions/.github/workflows/ai-review-human.yml@main
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/claude-review-merge-queue.yml b/.github/workflows/ai-review-merge-queue.yml
similarity index 54%
rename from .github/workflows/claude-review-merge-queue.yml
rename to .github/workflows/ai-review-merge-queue.yml
index f76337f9..227d9717 100644
--- a/.github/workflows/claude-review-merge-queue.yml
+++ b/.github/workflows/ai-review-merge-queue.yml
@@ -1,4 +1,4 @@
-name: Claude Review (merge queue)
+name: AI Review (merge queue)
 
 on:
   merge_group:
@@ -9,6 +9,6 @@ permissions: {}
 
 jobs:
   pass:
-    uses: Kong/volcano-actions/.github/workflows/claude-review-merge-queue.yml@main
+    uses: Kong/volcano-actions/.github/workflows/ai-review-merge-queue.yml@main
     permissions:
       statuses: write
diff --git a/.github/workflows/claude-review-retarget-override.yml b/.github/workflows/ai-review-retarget-override.yml
similarity index 74%
rename from .github/workflows/claude-review-retarget-override.yml
rename to .github/workflows/ai-review-retarget-override.yml
index bd589a45..d11e7658 100644
--- a/.github/workflows/claude-review-retarget-override.yml
+++ b/.github/workflows/ai-review-retarget-override.yml
@@ -1,4 +1,4 @@
-name: Claude Review (retarget and override)
+name: AI Review (retarget and override)
 
 on:
   pull_request_target:
@@ -9,8 +9,8 @@ permissions: {}
 
 jobs:
   retarget-or-override:
-    if: github.event.changes.base || github.event.label.name == 'claude-review-override'
-    uses: Kong/volcano-actions/.github/workflows/claude-review.yml@main
+    if: github.event.changes.base || github.event.label.name == 'ai-review-override'
+    uses: Kong/volcano-actions/.github/workflows/ai-review.yml@main
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/ai-review.yml
similarity index 76%
rename from .github/workflows/claude-review.yml
rename to .github/workflows/ai-review.yml
index 0c4c552c..91a3dbb7 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -1,4 +1,4 @@
-name: Claude Review
+name: AI Review
 
 on:
   pull_request_target:
@@ -8,8 +8,8 @@ on:
 permissions: {}
 
 jobs:
-  claude-review:
-    uses: Kong/volcano-actions/.github/workflows/claude-review.yml@main
+  ai-review:
+    uses: Kong/volcano-actions/.github/workflows/ai-review.yml@main
     permissions:
       contents: read
       pull-requests: write

From 7dfc797ca1567d0544b46f9ce0597ee606e72347 Mon Sep 17 00:00:00 2001
From: Sean Keever <33592180+swkeever@users.noreply.github.com>
Date: Wed, 14 Oct 2026 17:45:01 -0400
Subject: [PATCH 4/4] ci(review): run Codex with the ChatGPT access token

---
 .github/workflows/ai-review-retarget-override.yml | 2 +-
 .github/workflows/ai-review.yml                   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ai-review-retarget-override.yml b/.github/workflows/ai-review-retarget-override.yml
index d11e7658..d297916e 100644
--- a/.github/workflows/ai-review-retarget-override.yml
+++ b/.github/workflows/ai-review-retarget-override.yml
@@ -17,4 +17,4 @@ jobs:
       statuses: write
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
-      openai_api_key: ${{ secrets.OPENAI_CI_API_KEY }}
+      codex_access_token: ${{ secrets.CODEX_CI_ACCESS_TOKEN }}
diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 91a3dbb7..768f5159 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -16,4 +16,4 @@ jobs:
       statuses: write
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_CI_API_KEY }}
-      openai_api_key: ${{ secrets.OPENAI_CI_API_KEY }}
+      codex_access_token: ${{ secrets.CODEX_CI_ACCESS_TOKEN }}