ci: automated PR reviews (Claude, CodeRabbit, Gemini)

.coderabbit.yaml

@@ -0,0 +1,14 @@
+# CodeRabbit config. Install the app: https://github.com/apps/coderabbitai
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+  poem: false
+  review_status: true
+  collapse_walkthrough: true
+  auto_review:
+    enabled: true
+    drafts: false
+chat:
+  auto_reply: true

.gemini/config.yaml

@@ -0,0 +1,10 @@
+# Gemini Code Assist config. Install the app: https://github.com/apps/gemini-code-assist
+have_fun: false
+code_review:
+  disable: false
+  comment_severity_threshold: MEDIUM
+  max_review_comments: -1
+  pull_request_opened:
+    help: false
+    summary: true
+    code_review: true

.github/workflows/claude-review.yml

@@ -0,0 +1,52 @@
+name: Claude PR Review
+
+# Runs on the repo owner's Claude subscription (CLAUDE_CODE_OAUTH_TOKEN from
+# `claude setup-token`), not paid API credits. Triggers are kept narrow to save
+# plan quota: new / ready / reopened PRs, plus the `claude-review` label to re-run.
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, labeled]
+
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    # Skip drafts, PRs from forks (no secret access), and unrelated label events.
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (github.event.action != 'labeled' || github.event.label.name == 'claude-review')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Review this pull request. Read AGENTS.md / CONTRIBUTING.md first if present
+            and hold the change to the repo's own conventions.
+
+            Focus on, in order: correctness bugs, security problems, broken invariants
+            or contracts, missing tests for changed behavior, and performance regressions.
+            Skip formatting and style nitpicks that linters already catch.
+
+            Leave an inline comment for each concrete issue on the exact line, saying what
+            breaks and how to fix it. Then post one short summary comment with
+            `gh pr comment`. If you find nothing worth flagging, say so in one line.
+          claude_args: |
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,Glob,Grep"