human:review.
The pipeline on this repo, dryvist/docs, uses six thin
caller files in .github/workflows/ that delegate to reusable workflows in
JacobPEvans/.github-ai. Each caller is 10–30
lines; the AI work all lives in the upstream reusable workflow.
What runs, in order
How the six callers connect
The hub is the consumer repo; each caller is a one-shot wrapper around an upstream reusable workflow. They run independently when their trigger fires.What each caller actually contains
A caller is the minimum YAML to declare a trigger, set permissions, and call the upstream:post-merge-docs-review.ymluses the Post-Merge Dispatch Pattern. It is a two-job file becausepushevents aren’t supported byclaude-code-action@v1, so the caller re-dispatches asworkflow_dispatch.
Secrets the pipeline needs
Rate and safety guards
The reusable workflows enforce conservative defaults so a runaway loop can’t burn cloud spend:issue-resolver.yml:max_attempts: 1per issue,daily_limit: 5per repo, and it skips any issue labeledexcluded_labels: "type:security,type:feature,type:breaking,size:l,size:xl"- All workflows: fork PRs blocked by
if:guards, branch protection enforces the final merge gate
The pieces this doesn’t include
The cloud pipeline opens a ready PR labeledhuman:review and provides AI review. It does NOT:
- Mark the PR ready for merge: that’s a human decision
- Click the merge button: never automated
- Override branch protection or required reviewers
- Touch repos outside the current org boundary
/ship and /finalize-pr.
Where to go next
ai-workflows
Reusable workflows, pinned catalog prompts, event-triggered and scheduled.
claude-code-routines
The cron half: six routines that scan the org and pick up loose ends.
ai-workflows getting started
Caller templates and the live workflow catalog.
Authentication
AI_TOKEN, provider routing, and model variables.