Enable AI review and assistance on UCI

[alexander-sei]

Summary

• add the same SHA-pinned UCI v0.0.17 assistant and review callers used by runbooks #115
• gate requests to sei-protocol/sei-core, support explicit @seidroid review requests, and keep Cursor disabled to avoid duplicating Bugbot
• name the review caller ai-review-self.yml because ai-review.yml is the existing published reusable workflow

Test plan

• Compare both caller workflows with the runbooks configuration
• Run actionlint on both new workflows
• Run git diff --check

Made with Cursor

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 191da3d. Configure here.}

[cursor]

Skip label triggers omitted

Low Severity

The review caller omits labeled and unlabeled from pull_request types. The reusable workflow and its README both require those events so adding or removing ai: skip-review takes effect immediately; without them the skip switch only applies on the next push, and an in-flight review is not cancelled when the label is added.

 

^{Reviewed by Cursor Bugbot for commit 191da3d. Configure here.}

[github-actions]

Adds two SHA-pinned caller workflows so uci dogfoods its own ai-review.yml / ai-assistant.yml reusable workflows; permissions, event triggers, and the bot/team gating all line up with .github/seidroid/ai-review/README.md. Two non-blocking config gaps: the skip-review label trigger types are omitted, and the uses: SHA and uci-ref pins can drift apart under dependabot.

Findings: 0 blocking | 3 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• Because uci pins uses:/uci-ref to a fixed SHA of itself, PRs that modify .github/workflows/ai-review.yml, ai-assistant.yml, or the prompts under .github/seidroid/ai-review/ are reviewed by the previously released copy, not the version under review. That is the safe default, but it does mean workflow changes here are never exercised before release — worth calling out in the README so the pin bump is a deliberate release step.
• 2 suggestion(s)/nit(s) flagged inline on specific lines.

[github-actions]

[suggestion] labeled and unlabeled are missing from the trigger types, so the ai: skip-review switch won't behave as documented. ai-review.yml states: "For adding/removing the label to take effect immediately (not just on the next push), the caller should include labeled and unlabeled in its pull_request trigger types" (.github/workflows/ai-review.yml:16-19), and the canonical example in .github/seidroid/ai-review/README.md:38 includes them. With the current list, removing the label never re-triggers a review until the next push. Adding them is safe — resolve ignores label events whose label.name isn't the configured skip label (.github/workflows/ai-review.yml:255-257).

Suggested change

	types: [ opened, ready_for_review, synchronize, reopened ]
	types: [ opened, ready_for_review, synchronize, reopened, labeled, unlabeled ]

[github-actions]

[suggestion] The uses: ref and uci-ref are two independent copies of the same SHA, and only one of them is machine-maintained. .github/dependabot.yml enables the github-actions ecosystem, so dependabot can bump the uses: SHA on line 15 but will not touch this uci-ref input — leaving the workflow running new code while fetching prompts from a stale ref, which the README explicitly warns against ("set uci-ref to the same ref you pin uses: to", .github/seidroid/ai-review/README.md:21). Same pattern in ai-assist.yml lines 12/21.

Two cheap mitigations: use the trailing @<sha> # v0.0.17 comment form dependabot understands so at least the version marker stays truthful, and/or add these callers to a dependabot.yml ignore entry so the pin is only ever bumped by hand as part of a release.