feat: ACNA-4515 add pr-reviewer workflow

[chsrimanaswi]

Description

Adds an AI-powered PR reviewer workflow that automatically reviews pull requests using Claude via AWS Bedrock. Triggers on PR open/reopen/synchronize and on /review or /pr-reviewer comments by admins or maintainers.

Related Issue

ACNA-4515

Motivation and Context

Reduces code review toil by providing automated first-pass reviews with inline suggestions. Part of a broader rollout across App Builder repos.

How Has This Been Tested?

Tested end-to-end in adobe/generator-aio-app — workflow triggers correctly on PR events and /review comments, posts inline suggestions and summary reviews via github-actions[bot].

Screenshots (if appropriate):

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[github-actions]

🤖 PR Reviewer

The workflow is well-structured with a clear gate/review separation. There are two minor issues: the gh api call for PR data is not protected against injection via environment variables (low risk here since ISSUE_NUMBER comes from GitHub context), and the @main pin on the reusable workflow is mutable and could introduce supply-chain risk. Overall the logic is sound and the permission gating is appropriately conservative.

📝 2 suggestion(s) - Please review inline comments below.

---

💡 How to re-trigger

Comment /review or /pr-reviewer on this PR

[github-actions]

The gh api call interpolates $GITHUB_REPOSITORY and $ISSUE_NUMBER directly into the shell command string. While these values come from GitHub Actions context (not user input), it is safer and more idiomatic to pass them as path parameters using the --field flag or use the pre-set env var. More critically, $ISSUE_NUMBER is derived from github.event.issue.number which is an integer and safe, but for consistency and future-proofing the call should be quoted.

Suggested change

	DATA=$(gh api repos/$GITHUB_REPOSITORY/pulls/$ISSUE_NUMBER)
	DATA=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${ISSUE_NUMBER}")

[github-actions]

Pinning a reusable workflow to @main means any update to that branch (including potentially malicious ones) is immediately picked up. For supply-chain security, pin to a specific commit SHA or a tagged release instead.

Suggested change

	uses: adobe/aio-reusable-workflows/.github/workflows/pr-review.yml@main
	uses: adobe/aio-reusable-workflows/.github/workflows/pr-review.yml@<commit-sha-or-tag>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Proposed changes not required