From 50952f8a6c3c6b24cbc84f0d7c5d3fd562854d7e Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Sun, 23 Aug 2026 18:57:41 +0200
Subject: [PATCH 1/2] ci: request exact-head AI reviews on PR updates

---
 .github/workflows/request-ai-reviews.yml | 37 ++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/request-ai-reviews.yml

diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml
new file mode 100644
index 00000000..cd3f4730
--- /dev/null
+++ b/.github/workflows/request-ai-reviews.yml
@@ -0,0 +1,37 @@
+name: Request AI reviews
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - ready_for_review
+      - synchronize
+
+# The workflow runs from the trusted base branch and never checks out or
+# executes contributor code. It only posts a head-stamped PR comment.
+permissions: {}
+
+concurrency:
+  group: ai-review-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}
+  cancel-in-progress: true
+
+jobs:
+  request:
+    if: ${{ !github.event.pull_request.draft }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Request exact-head reviews
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          body=$(printf '@coderabbitai review\n\n@codex review\n\nRequested for exact head `%s`.\n<!-- factory-ai-review-request:%s -->' "$HEAD_SHA" "$HEAD_SHA")
+          gh api \
+            --method POST \
+            "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
+            --raw-field body="$body"

From b64a338b0b08093ef02fba01585bfbb3e9fb5400 Mon Sep 17 00:00:00 2001
From: Khaliq <khaliqgant@gmail.com>
Date: Sun, 23 Aug 2026 19:00:16 +0200
Subject: [PATCH 2/2] ci: limit review requester to comment permission

---
 .github/workflows/request-ai-reviews.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/request-ai-reviews.yml b/.github/workflows/request-ai-reviews.yml
index cd3f4730..d26d4aa0 100644
--- a/.github/workflows/request-ai-reviews.yml
+++ b/.github/workflows/request-ai-reviews.yml
@@ -21,7 +21,6 @@ jobs:
     if: ${{ !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     permissions:
-      contents: read
       issues: write
     steps:
       - name: Request exact-head reviews