Migrate to shared claude-code-review.yml reusable workflow

[jnasbyupgrade]

Replaces the hand-maintained review workflow with a thin caller into Postgres-Extensions/ai's reusable workflow_call version, pinned @main. The caller mandates reading ai/CI-WORKFLOWS.md in full plus an Exceptions: line, per that doc's own convention — no rationale restated here.

Can't be validated by this PR's own CI: pull_request_target always runs from the base branch, so verification happens post-merge, on the next PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1febc533-5215-4739-bb01-c44f8580f1f8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 6m 34s —— View job

---

I'll analyze this and get back to you.

[github-actions]

Correctness/efficiency: Adding labeled to the trigger types fires this whole (paid, secret-bearing) review job on every label added to the PR, not just an intended debug/rerun label — GitHub Actions has no way to filter by label value in on:, and nothing in this file gates on github.event.label.name. The concurrency.group expression on line 14 distinguishes claude-debug from other labels, but that only affects which concurrency bucket a run lands in — it doesn't prevent the run from being scheduled in the first place. Applying an unrelated label (bug, needs-triage, documentation, etc.) will kick off a brand-new full review run in its own concurrency group, unless the callee (Postgres-Extensions/ai/.github/workflows/claude-code-review.yml) independently re-checks github.event.label.name and bails for anything other than the intended trigger label — which this file gives no evidence of.

Failure scenario: A maintainer applies the "documentation" label to a PR to categorize it → a new Claude review job spins up and spends API budget/CI minutes for a purely administrative labeling action, repeatable for every distinct label ever applied.

[github-actions]

Security: This deletes the inline if: github.event.pull_request.draft == false && github.event.pull_request.user.login == 'jnasbyupgrade' gate that this very file's own (now-removed) comments called "the ONLY thing standing between an arbitrary external actor's PR and this job's write-capable GITHUB_TOKEN and CLAUDE_CODE_OAUTH_TOKEN," and replaces it with trusted_authors: jnasbyupgrade passed to an external reusable workflow pinned to a mutable @main ref. Nothing in this file demonstrates that the callee re-implements the check against pull_request.user.login (rather than something spoofable like github.actor, which is exactly the class of subtle mistake this repo's own removed comments warned about — see the retired note about head.repo.owner.login silently failing to gate upstream-branch-headed PRs) or that it still skips drafts.

Failure scenario: If Postgres-Extensions/ai's reusable workflow checks a spoofable/insufficient field (or omits the draft check) when interpreting trusted_authors, an untrusted PR (fork or upstream-branch-headed) could trigger a job that runs with this repo's write-capable secrets — precisely the scenario the deleted comment block was written to prevent. Recommend confirming (in the ai repo) that the equivalent check is intact before/independently of this merge.

[github-actions]

Correctness (regression risk): This deletes the claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment' input and the --comment flag on the prompt:, both of which this repo's own removed comments say were added to fix a previously-silent failure mode: "every review run before this fix has been silently invisible on GitHub" (no error, just no comments posted). That wiring now lives entirely inside the external Postgres-Extensions/ai reusable workflow (pinned to mutable @main), and nothing in this diff shows it's preserved there.

Failure scenario: If the reusable workflow's default prompt/args omit the equivalent --comment/allowedTools wiring, this workflow will run to completion, appear green in Actions, and post nothing to the PR — the exact silent-failure regression this repo already hit once and fixed, recurring without any visible signal in CI.

[github-actions]

Altitude: The claude-debug-vs-other-label special case is embedded directly in this per-repo caller's concurrency.group expression rather than in the shared reusable workflow. If this pattern (debug label re-triggers the same concurrency slot; any other label gets its own) is meant to be uniform org-wide — as the "thin caller" migration intends for everything else — every consuming repo now has to hand-copy this exact ternary expression correctly instead of the shared workflow computing/exposing it once. A simpler, more general fix would be for the reusable workflow itself to derive the concurrency group (e.g. via a workflow_call concurrency: inherited from the caller isn't possible in Actions, but the label-name special-casing logic could still be centralized/exposed as an output rather than duplicated per caller).