feat(docs): add claude reviewer workflows

Author: just-toby

.claude/review.yml

@@ -0,0 +1,21 @@
+# review-cli config for Uniswap/docs.
+# Schema reference: packages/review-cli/src/config.ts in Uniswap/internal-tools.
+
+# Default model for all claude-runtime review agents. The bundled
+# agents declare `model: sonnet` in frontmatter, which resolve-model
+# treats as "unpinned", so this config default is what actually
+# selects the model.
+model:
+  default: claude-opus-4-8
+
+# Per-agent budget — soft cap on each agent's investigation.
+agent_budget_usd: 5.0
+
+# Per-agent turn ceiling — set well above any reasonable investigation
+# depth so the budget is always the cap, never turns.
+agent_max_turns: 500
+
+# Disable the trivial-threshold skip — every PR gets reviewed,
+# regardless of size. Tiny diffs are especially meaningful in a docs
+# repo (typos in user-facing copy, wrong addresses, broken links).
+trivial_threshold: 0

.github/actions/install_review_cli/action.yml

@@ -0,0 +1,53 @@
+name: 'Install review-cli'
+description: 'Set up Bun and install @uniswap/review-cli from GitHub Packages into an isolated $RUNNER_TEMP directory.'
+
+inputs:
+  version:
+    description: '@uniswap/review-cli version to install (e.g. 1.2.0). Pin via vars.REVIEW_CLI_VERSION at the call site.'
+    required: true
+  github-token:
+    description: 'Token with packages:read scope. Typically secrets.GITHUB_TOKEN.'
+    required: true
+  bun-version:
+    description: 'Bun runtime version. Must satisfy @uniswap/review-cli engines (>=1.3.13).'
+    default: '1.3.13'
+
+outputs:
+  bin-path:
+    description: 'Absolute path to the directory containing the review-cli binary. Callers should invoke "${bin-path}/review-cli" rather than relying on $PATH.'
+    value: ${{ steps.install.outputs.bin-path }}
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      with:
+        bun-version: ${{ inputs.bun-version }}
+
+    # @uniswap/review-cli is private on GitHub Packages, and Bun (like npm)
+    # only supports per-SCOPE registry overrides. Installing from a scratch
+    # dir with its own bunfig.toml routes @uniswap to GH Packages without
+    # touching the repo's own registry config. Transitive deps (no
+    # @uniswap/*) come from npmjs.org per bun's built-in default.
+    #
+    # Bin path is exposed via the `bin-path` step output rather than
+    # written to GITHUB_PATH — the output forces callers to opt in
+    # explicitly per-step (zizmor `github-env`).
+    - name: Install @uniswap/review-cli (isolated registry context)
+      id: install
+      shell: bash
+      env:
+        GH_PACKAGES_TOKEN: ${{ inputs.github-token }}
+        REVIEW_CLI_VERSION: ${{ inputs.version }}
+      run: |
+        set -euo pipefail
+        install_dir="$RUNNER_TEMP/review-cli-install"
+        mkdir -p "$install_dir"
+        cat > "$install_dir/bunfig.toml" <<EOF
+        [install.scopes]
+        "@uniswap" = { url = "https://npm.pkg.github.com", token = "$GH_PACKAGES_TOKEN" }
+        EOF
+        cd "$install_dir"
+        bun init -y > /dev/null
+        bun add "@uniswap/review-cli@${REVIEW_CLI_VERSION}"
+        echo "bin-path=$install_dir/node_modules/.bin" >> "$GITHUB_OUTPUT"

.github/actions/security_scan/action.yml

@@ -0,0 +1,27 @@
+name: 'Security Scan'
+description: 'Centralized bullfrog security scanning - disable via SECURITY_SCAN_ENABLED input'
+
+inputs:
+  enabled:
+    description: 'Set to vars.SECURITY_SCAN_ENABLED from the calling workflow (default: true)'
+    default: 'true'
+  allowed-ips:
+    description: 'List of IPs to allow outbound connections to'
+    default: ''
+  allowed-domains:
+    description: 'List of domains to allow outbound connections to'
+    default: ''
+  egress-policy:
+    description: 'Egress policy: audit or block'
+    default: 'audit'
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Security Scan
+      if: inputs.enabled == 'true'
+      uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4
+      with:
+        allowed-ips: ${{ inputs.allowed-ips }}
+        allowed-domains: ${{ inputs.allowed-domains }}
+        egress-policy: ${{ inputs.egress-policy }}