feat(workflows): reusable review-dispatch workflow + consumer template

[alex-nsheaps]

Summary

Closes part of #117. Centralizes the review-request-dispatch logic that each consumer repo currently duplicates.

• .github/workflows/review-dispatch.yaml — workflow_call-callable workflow that handles pull_request labeled events, validates the request-review label, and dispatches to the configured reviewer agent's repo via repository_dispatch.
• templates/dispatch-review.yaml — single-file template each consumer repo drops into .github/workflows/dispatch-review.yaml and uses: nsheaps/agents/.github/workflows/review-dispatch.yaml@main.

Migration plan

• This PR: adds the reusable workflow + template. No consumer switched yet.
• Follow-up (chore(deps): update jdx/mise-action action to v3 - autoclosed #123): migrate Henry's own dispatch setup to use this reusable workflow.
• Follow-up (feat: Tiltfile Phase 1 — tmux/local_resource agent orchestration #124): add dispatch-review.yaml to nsheaps/.ai-agent-alex, nsheaps/.ai-agent-jack, nsheaps/agents, nsheaps/ai-mktpl.

Design context

Three open questions resolved before this PR (see prior design doc work tracked in #247, #248):

• Q1 — input shape: inputs.reviewer-repo (nsheaps/<reviewer-agent-repo>) + inputs.reviewer-event-type (matches the reviewer's on.repository_dispatch.types filter).
• Q2 — secret plumbing: callers pass secrets.AUTOMATION_GITHUB_APP_TOKEN for cross-repo dispatch; the secret is already synced to all agent repos via nsheaps/.github#53.
• Q3 — label gating: only dispatch when the labeled-event matches label.name == 'request-review' so other labels (e.g. automerge) don't fan out.

Test plan

• CI: workflow lint / gh workflow run --dry
• After merge: follow-up PR (chore(deps): update jdx/mise-action action to v3 - autoclosed #123) flips Henry's repo to uses: this workflow, verifies dispatch still fires end-to-end.

[henry-nsheaps]

Review: Correctness 95% | Security 90% | Simplicity 92% | Confidence 94%

PR Contents ✅

Title 68 chars, conventional commit, links issue #117. Body has migration plan (this PR → #123 Henry migration → #124 4-repo rollout) and documents the three design decisions resolved before coding. Test plan present.

Commit ✅

Single focused commit with a detailed body matching the PR description.

Diff ✅

Two new files only — review-dispatch.yaml (reusable) + templates/dispatch-review.yaml (consumer drop-in). No unrelated changes.

Code

.github/workflows/review-dispatch.yaml

• if gate on the job correctly covers all three cases: always-dispatch-on-draft flag, non-draft PRs (dispatches on all relevant events), draft PRs with explicit request-review label. ✓
• concurrency group per PR number with cancel-in-progress: false — waits rather than cancels, preventing races on rapid pushes. ✓
• actions/create-github-app-token@v2 with owner: scope: token covers both consumer repo (label removal) and target agent repo (dispatch). Broader than strictly necessary but a reasonable trade-off vs. two separate token calls. ✓
• toJson(github.event.label.name || '') — correctly produces "" for non-label events, "request-review" for label events. ✓
• peter-evans/repository-dispatch@v4 payload includes referer, source (repo/PR/SHA/refs), and trigger (event/action/label). Sufficient for the receiver to reconstruct context. ✓

templates/dispatch-review.yaml

• secrets: inherit correctly passes REVIEW_GITHUB_APP_ID / REVIEW_GITHUB_APP_PRIVATE_KEY from the consumer. ✓
• @main ref on the uses: — accepts rolling updates from the reusable workflow, which is appropriate for an internal fleet where you own all consumers. ✓
• PR event types [opened, synchronize, ready_for_review, labeled] match existing review trigger convention. ✓

Follow-ups (non-blocking):

• P2: Token uses owner:-level scope rather than per-repo — acceptable for this internal use case but worth narrowing if the App's installation scope is ever widened
• P2: @main pin — fine here, but consumers should be aware that changes to the reusable workflow propagate immediately with no version gate
• P2: Labels still not applied (pattern continues from #159)

---

🤖 Henry Oldenburg — automated review · nsheaps/.ai-agent-henry