Add AI code review workflow with Dependabot skip

[circlecube]

Summary

• Add the shared AI code review workflow
• Skip the workflow on Dependabot PRs, since GitHub withholds org secrets from Dependabot-context runs

Test plan

• Verify workflow YAML is valid
• Confirm AI code review runs on normal PRs
• Confirm Dependabot PRs skip the review job (job shows as skipped, not failed)

[github-actions]

AI code review

✅ Strengths

• Centralized, reusable workflow adoption with clear inputs and secrets mapping; keeps logic DRY across repos.
• Sensible guards: skips drafts and fork PRs to avoid secret exposure; concurrency configured to prevent duplicate runs.
• Scoped token permissions at the job level (contents: read, pull-requests: write, checks: write) instead of broad defaults — good least-privilege posture.
• tests/wpunit updates set an editor user context for hooks registration, reducing flakiness and improving test determinism.

⚠️ Suggestions (non-blocking)

• Pin the reusable workflow to a commit SHA rather than @main to reduce supply-chain risk; set prompts_ref to the same SHA for consistency.
• Consider adding issues: write to permissions if the reusable workflow posts regular PR conversation comments (issue comments). Some implementations require it; otherwise comment updates can 403.
• In the tests, consider wrapping wp_set_current_user changes in a try/finally to guarantee cleanup even if assertions fail.

❌ Issues (blocking / critical)

• Dependabot skip guard uses github.actor. On Dependabot-authored PRs, if a maintainer pushes or retriggers, actor may not be dependabot[bot], but secrets are still withheld for the PR. This can cause hard failures instead of the intended skip. Use github.event.pull_request.user.login == 'dependabot[bot]' (or an equivalent condition) to reliably skip based on PR author, not actor.

Follow-up vs. prior feedback

• ⚠️ The prior approval calls out a Dependabot skip guard. While present, basing the skip on actor can miss some Dependabot PR event paths. Using the PR author login is more robust and aligns with the stated goal of avoiding secret-withholding failures.

Verdict

❌ Verdict: Request changes — please switch the Dependabot skip to check the PR author (not the actor), and consider pinning the reusable workflow to a SHA. After that, this looks good to merge.

[arunshenoy99]

LGTM — adds the shared AI code review workflow with a Dependabot skip guard to avoid secret-withholding failures.

[github-actions]

Coverage: Base 44.74% → PR 47.85% (must not decrease).
✅ No decrease.

project coverage report 47.85% @ 79a5ab6

[circlecube]

Fixed the failing wpunit test so we can merge