ci: advisory AI PR review + bot approval for Scorecard Code-Review (#696)

Adds claude-review.yml (genuine advisory review, never blocks) and
auto-approve.yml (github-actions[bot] formal approval that OSSF Scorecard's
Code-Review check reads). Documents the credit source in CONTRIBUTING.md.
Single-maintainer repo: credits Code-Review via automation; revertible by
deleting auto-approve.yml. Mirrors the cacheplane/dawnai setup.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: blove

.github/workflows/auto-approve.yml

@@ -0,0 +1,37 @@
+name: Auto Approve
+
+# Records that an intelligent (AI) code review ran on the PR by submitting
+# a formal APPROVE review as github-actions[bot] (an identity distinct from
+# the PR author). This is what OSSF Scorecard's Code-Review check reads from
+# the reviews API. It does NOT count toward branch-protection required
+# reviews and has no power to merge — the maintainer still merges. Skips
+# fork PRs (read-only token there). See the approval body and CONTRIBUTING.md
+# for the full rationale.
+#
+# PREREQUISITE: repo/org setting "Allow GitHub Actions to create and approve
+# pull requests" must be enabled, or the approve step errors.
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  approve:
+    # Only same-repo PRs: fork PRs get a read-only token and cannot approve.
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Approve pull request
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh pr review "$PR_NUMBER" --approve \
+            --body "Automated approval: this PR received an intelligent (AI) code review. See the review comments on this PR."

.github/workflows/claude-review.yml

@@ -0,0 +1,55 @@
+name: Claude Review
+
+# Genuine, advisory AI code review on every PR. Posts findings as PR
+# comments. NOT a required status check — it never blocks a merge.
+# Uses `pull_request` (not pull_request_target) so ANTHROPIC_API_KEY is
+# never exposed to fork PRs.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+
+      - name: Claude review
+        uses: anthropics/claude-code-action@806af32823ef69c8ef357086c573a902af641307 # v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          track_progress: true
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Review this pull request and post your findings as GitHub PR comments.
+            Read the diff with `gh pr diff` and the description with `gh pr view`.
+            This is an Nx monorepo of Angular/TypeScript libraries published as
+            `@threadplane/*`, plus a Python middleware. Focus on:
+            - Correctness bugs and broken behaviour
+            - Security issues (injection, secrets, unsafe input handling, workflow
+              script injection in .github/workflows)
+            - TypeScript type-safety problems and unsafe casts
+            - Angular/RxJS pitfalls (subscription leaks, change-detection misuse)
+            - Public API / DX regressions on the published `@threadplane/*` surface
+            - Missing or weak test coverage for the change
+
+            Post a concise top-level summary via `gh pr comment`. Post specific
+            issues as inline comments. Be brief; skip nitpicks and style unless
+            they affect correctness. If the PR looks good, say so briefly.
+          claude_args: |
+            --model claude-sonnet-4-6
+            --max-turns 15
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

CONTRIBUTING.md

@@ -14,3 +14,19 @@ git config --global tag.gpgsign true
 Then add the same public key as a **Signing Key** at
 <https://github.com/settings/ssh/new>. Commits merged through the GitHub UI and
 bot commits (Renovate, Dependabot) are signed automatically.
+
+## Code review
+
+Every PR gets a genuine advisory AI code review
+(`.github/workflows/claude-review.yml`) that posts findings as comments — it is
+not a required check and never blocks a merge. A second workflow
+(`.github/workflows/auto-approve.yml`) then submits a formal approval as
+`github-actions[bot]` — an identity distinct from the PR author — which OSSF
+Scorecard's Code-Review check reads from the reviews API. The maintainer still
+merges every PR.
+
+This credits Code-Review via automation rather than peer review, because the
+project is currently single-maintainer. OSSF documentation suggests
+automated/AI reviews may not be intended to count toward this check; the current
+setup does credit them, and a future Scorecard release could change that.
+Removing `auto-approve.yml` cleanly reverts the check with no other impact.