added PR reviewer workflow

[derekmisler]

What I did

Added an automated PR review workflow powered by the shared docker/cagent-action reusable workflow. This enables AI-assisted code review on every new or ready-for-review PR, as well as on-demand via /review in PR comments. The workflow feeds the repo's CLAUDE.md as additional context so reviews are informed by project-specific conventions.

Key details:

• Triggers on PR opened, PR marked ready for review, issue comments, and review comments
• Uses pull_request_target so secrets are available even for fork PRs
• Explicitly passes required secrets rather than using secrets: inherit
• Reviews appear under the docker-agent identity (not the generic github-actions[bot])
• Auto-reviews are gated to org members only via CAGENT_ORG_MEMBERSHIP_TOKEN
• Scoped permissions: read for contents, write for pull-requests and issues

Related issue

Closes https://github.com/docker/gordon/issues/132

(not mandatory) A picture of a cute animal, if possible in relation to what you did

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85814c892f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin reusable workflow to an immutable ref

Calling docker/cagent-action/.github/workflows/review-pr.yml@latest makes execution depend on a mutable upstream ref, so future tag moves can silently change behavior or run compromised code while this job has write permissions and receives ANTHROPIC_API_KEY and app private key secrets. Pinning to a commit SHA (or tightly controlled immutable release ref) is needed to prevent supply-chain drift and secret-handling risk introduced by this workflow.

Useful? React with 👍 / 👎.

[derekmisler]

i'll leave that up to you all. other teams are cool with using @latest, so they can easily stay up-to-date, but I'm fine with a hash instead

[derekmisler]

The latest (immutable) tag is v1.1.8, if you'd prefer. Otherwise I can include the hash (pinata requires it, for example)

[chatgpt-codex-connector]

Gate issue_comment runs to PR comments only

issue_comment events are emitted for both issues and pull requests, but this workflow unconditionally dispatches the review job, so ordinary issue comments can trigger the reviewer path without PR context. In repos where non-PR issue comments are common, this causes unnecessary runs (and unnecessary secret-bearing executions) and can produce failures/noise if the called workflow expects a PR payload; add an if: github.event.issue.pull_request guard for this path.

Useful? React with 👍 / 👎.

[derekmisler]

the workflow handles this