Migrate to Postgres-Extensions/ai shared Claude workflows

[jnasbyupgrade]

Replace both .github/workflows/claude-code-review.yml and .github/workflows/claude.yml with thin workflow_call callers into the shared reusable workflows defined in Postgres-Extensions/ai, per that repo's CI-WORKFLOWS.md. All trigger logic, gating, and claude-code-action configuration now live there instead of being duplicated per repo. trusted_authors/trusted_actors are both set to jnasbyupgrade, matching this repo's existing trust gates in each file.

This does not take effect until Postgres-Extensions/ai#30 merges to main — until then, the uses: Postgres-Extensions/ai/.github/workflows/...@main references below point at files that don't exist yet on ai/main, and any workflow run triggered against this branch/PR will fail at parse time. That's expected, not a defect in this PR.

Verification, and it needs both PRs merged, not just ai#30:

• claude-code-review.yml (pull_request_target) always reads the workflow file from the base branch, so no PR against this repo can ever exercise its own change to this file — a later PR proves it out, after both this PR and ai#30 have merged.
• claude.yml triggers on issue_comment/issues/pull_request_review/pull_request_review_comment. Per GitHub's own trigger-resolution rules, issue_comment and issues also read the workflow from the base branch (same limitation as above) — a plain @claude mention in a comment needs this PR merged to master first, not just ai#30. Only pull_request_review/pull_request_review_comment resolve against the PR's merge ref and could exercise this PR's own version pre-merge.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 1feed3f1-a4f7-4247-a1e8-61e013b1fd72

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 2m 28s —— View job

---

Review: Migrate to Postgres-Extensions/ai shared Claude workflows

• Gather context (PR diff, workflow files, CLAUDE.md)
• Review changed workflow files
• Post review feedback

Reviewed .github/workflows/claude-code-review.yml and .github/workflows/claude.yml against origin/master. Both files are well-formed workflow_call callers and structurally match the PR description's intent (all bespoke gating/checkout/action-config logic removed in favor of uses: Postgres-Extensions/ai/.github/workflows/{file}@main, with secrets: inherit).

One thing worth double-checking before/when ai#30 merges:

• .github/workflows/claude.yml line 27 — the actions permission changes from read to write. The old file (removed lines 32-33/40-41 in the diff) explicitly scoped this to actions: read # Required for Claude to read CI results on PRs, both as a job permission and as claude-code-action's own additional_permissions. The new caller grants actions: write instead. write is a strict superset of read here, so reading CI results still works, but the token now also carries the ability to cancel/re-run workflows and manage caches/artifacts for a job gated only on trusted_actors matching a comment author — a broader grant than the stated purpose needs. This may be intentional (e.g. parity with claude-code-review.yml's existing actions: write, needed there for cache-write per that file's own prior comment), but it's not explained in the PR body, and it's not verifiable from this PR alone since ai#30 hasn't merged. Worth confirming against ai/CI-WORKFLOWS.md's actual requirement for this input once that PR lands, and tightening back to read if write isn't actually needed.

Everything else checks out:

• trusted_authors: jnasbyupgrade / trusted_actors: jnasbyupgrade correctly preserve both files' existing single-trusted-account gates.
• The other retained permissions: entries (contents: read, pull-requests: write/read, checks: read, issues: read, id-token: write) match what the removed inline logic previously used.
• No workflow-level concurrency: block was dropped incorrectly — claude.yml never had one (only an explanatory comment), and claude-code-review.yml's group/cancel-in-progress config is preserved verbatim.
• Per this repo's own .github/workflows/CLAUDE.md, pull_request_target always runs the base branch's copy of the workflow file — so, as the PR body correctly notes, this PR's own claude-review check is still exercising the old inline version, not this diff. That's expected, not a gap in this PR.

I could not fetch Postgres-Extensions/ai's CI-WORKFLOWS.md or PR #30 in this session (no outbound network/gh access to other repos), so I wasn't able to independently confirm the shared workflows' actual workflow_call input/permission contracts (e.g. whether trusted_authors/trusted_actors are the right input names, or whether actions: write is genuinely required). That verification is still pending on ai#30 merging, consistent with what the PR description already flags.

No code changes made — this was a review-only pass.