feat(seidroid-review): add the agentic pull request reviewer as a reusable workflow

.github/workflows/workflow-test-self.yml

@@ -0,0 +1,144 @@
+name: Workflow tests
+# The shell and jq inside seidroid-review.yml, run against a gh stub, and its job
+# conditions evaluated against synthetic payloads. Nothing here reaches the GitHub
+# API, so this needs no token and no permissions.
+#
+# Five jobs, so each check in the list names the step it covers. A job that ran two
+# harnesses would report one name for two things, and one check would go red for the
+# other's failure.
+#
+# `Place findings and resolve threads` covers a pair of steps rather than either half:
+# placement records which thread each posted comment replaced, and the resolve step
+# closes on that record. `The reaction steps` covers which of the three runs in which
+# job state, and what each leaves on the trigger comment. `Guard the request` covers
+# the admission path, from the event the workflow accepts to the collection the
+# acknowledgement reaches.
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/seidroid-review.yml'
+      # run-guard.sh asserts what ai-assistant.yml claims of the same comment, so an
+      # edit there can break an invariant stated here. Without this the break lands
+      # on the next unrelated pull request that touches the file above, pointing at
+      # the wrong change.
+      - '.github/workflows/ai-assistant.yml'
+      - '.github/workflows/workflow-test-self.yml'
+      - 'test/seidroid-review/**'
+  push:
+    branches: [ main ]
+    paths:
+      - '.github/workflows/seidroid-review.yml'
+      # run-guard.sh asserts what ai-assistant.yml claims of the same comment, so an
+      # edit there can break an invariant stated here. Without this the break lands
+      # on the next unrelated pull request that touches the file above, pointing at
+      # the wrong change.
+      - '.github/workflows/ai-assistant.yml'
+      - '.github/workflows/workflow-test-self.yml'
+      - 'test/seidroid-review/**'
+permissions:
+  contents: read
+jobs:
+  place-findings:
+    name: Place findings and resolve threads
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+      - name: Install the YAML reader
+        run: python3 -m pip install --quiet pyyaml
+      - name: Run the placement and resolve harness
+        run: test/seidroid-review/run.sh
+
+  reactions:
+    name: The reaction steps
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+      - name: Install the YAML reader
+        run: python3 -m pip install --quiet pyyaml
+      - name: Run the reaction harness
+        run: test/seidroid-review/reactions.sh
+      # Which step runs in which job state, which is where the cancellation behaviour
+      # lives and which the shell harness above cannot see.
+      - name: Check the step conditions
+        run: python3 test/seidroid-review/conditions.py .github/workflows/seidroid-review.yml
+
+  review-position:
+    name: The review's position
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+      - name: Install the YAML reader
+        run: python3 -m pip install --quiet pyyaml
+      # Which review event the step records, per decision the driver wrote. Its own
+      # header says what it guards: the step used to derive the event from the
+      # conclusion instead, and a run whose driver recorded `approve` beside a neutral
+      # check posted a comment saying "Approving" and no review at all.
+      - name: Run the decision harness
+        run: test/seidroid-review/decision.sh
+
+  verdict-destination:
+    name: Where the verdict goes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+      - name: Install the YAML reader
+        run: python3 -m pip install --quiet pyyaml
+      # One verdict, in one place. The review carrying the inline comments holds it
+      # where that review landed, and a comment of its own holds it where none did.
+      # Both at once is the duplication this workflow was changed to remove; neither
+      # is a review the author cannot read.
+      - name: Run the verdict harness
+        run: test/seidroid-review/verdict.sh
+
+  review-limits:
+    name: The review's time limits
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+      - name: Install the YAML reader
+        run: python3 -m pip install --quiet pyyaml
+      # The driver's budget and the job cap, against each other and against a measured
+      # review. Neither a budget the reviews of the day already reach nor a cap under
+      # it stops the workflow parsing, and both publish nothing a reader can act on.
+      - name: Check the review's time limits
+        run: python3 test/seidroid-review/deadline.py .github/workflows/seidroid-review.yml
+
+  guard-admission:
+    name: Guard the request
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+      - name: Install the YAML reader
+        run: python3 -m pip install --quiet pyyaml
+      - name: Run the guard harness
+        run: test/seidroid-review/run-guard.sh

test/seidroid-review/.gitignore

@@ -0,0 +1,19 @@
+# Written by run.sh: the two steps extracted from the workflow, the fixtures it
+# generates, and one directory of output per case.
+place.sh
+resolve.sh
+fx/gen/
+out/
+# Written by reactions.sh: the three reaction steps, and one directory per case.
+ack.sh
+answer.sh
+withdraw.sh
+out-reactions/
+# Written by run-guard.sh: the five steps it extracts from the workflow. Two of
+# them are steps reactions.sh also extracts, under names of their own so neither
+# harness can overwrite the other's extraction.
+refuse.sh
+parse.sh
+admit.sh
+guard-ack.sh
+guard-answer.sh