Migrate to shared claude-code-review.yml reusable workflow

[jnasbyupgrade]

Replaces the hand-maintained review workflow with a thin caller into Postgres-Extensions/ai's reusable workflow_call version, so a future fix lands here without a manual copy. Pinned to @main, matching every other consumer of that shared workflow. This also picks up the --comment fix for the silent-review-failure bug that the old per-repo copy still carried, and the labeled-event/debug-label support ai/'s version added.

This PR cannot be fully validated by its own CI. A pull_request_target workflow change only takes effect after merging to the base branch, and even then it's only exercised by a subsequent PR event against this repo — this PR's own CI run still uses the old workflow file. What's verified here is structural correctness only: the YAML parses, Postgres-Extensions/ai/.github/workflows/claude-code-review.yml@main resolves, this repo's default workflow permissions (read) and secret availability (0 repo-level secrets, relying on the org-level one via secrets: inherit) match what every other caller relies on, and git merge-tree against upstream/master is clean.

Once merged, the real proof is the next PR opened against this repo.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 10c94100-dc0f-4549-b1c9-597a3a834c48

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 2m 15s —— View job

---

Review: Migrate to shared claude-code-review.yml workflow

• Gather context (PR diff, repo CLAUDE.md, diff against origin/master)
• Review changed workflow file
• Post review feedback

Summary

The caller file (.github/workflows/claude-code-review.yml) is a clean, well-commented thin wrapper. Walking through the logic that had to survive the migration:

• Concurrency-group expression (line 28) is correct: for a labeled event where the label isn't claude-debug, format('-{0}', github.event.label.name) always returns a non-empty string, so the &&/|| fallback idiom doesn't hit the classic empty-string-is-falsy footgun. For every other action (including labeled + claude-debug), it correctly falls back to the plain claude-review-<pr#> group, preserving prior behavior and letting a debug-label run supersede an in-progress review as the comment states.
• Permissions/secrets: permissions: on a job with uses: is valid syntax for scoping the token handed to a called reusable workflow, and secrets: inherit is the right call given no repo-level secrets exist (per the PR description). actions: write for cache writes is unchanged from before.
• The security-critical trusted-author gate is now delegated to the trusted_authors: jnasbyupgrade input rather than enforced locally — consistent with the stated goal of keeping all logic in ai/ so fixes propagate automatically.

Things worth double-checking before/after merge (not blocking, since this repo's own CI can't exercise pull_request_target changes pre-merge)

1. Draft-PR check dropped: the old workflow locally gated on github.event.pull_request.draft == false. That check isn't present in the new caller, so it's now implicit — it relies on Postgres-Extensions/ai's reusable workflow also skipping drafts. Worth confirming that's actually true over there, otherwise draft PRs from the trusted author will start incurring the paid review cost this repo previously avoided.
2. Unverified reusable-workflow contract: I couldn't fetch Postgres-Extensions/ai/.github/workflows/claude-code-review.yml@main from this sandbox to independently confirm the trusted_authors input name/semantics and that its debug_label default is literally claude-debug (line 26's comment says this has to be kept in sync by hand since inputs isn't readable in the caller's concurrency: block — a minor coupling to be aware of if ai/ ever changes that default without a corresponding note here).

Neither of these looks like a bug in this file — they're just the parts of the migration that only the next real PR run against this repo can actually prove out, as the PR description itself acknowledges.