feat(ai-review): switch to gpt-5.6-terra; add moving current tag

.github/workflows/ai-review.yml

@@ -296,7 +296,7 @@ jobs:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           prompt-file: .github/workflows/ai-review.prompt.md
           output-file: .github/codex/output/codex-final-message.md
-          model: gpt-5.3-codex
+          model: gpt-5.6-terra
           effort: high
           # the CLI floated to npm latest too; pinned to the release verified
           # clean with v1.11 so a CLI release can't change review behaviour
@@ -325,17 +325,17 @@ jobs:
         id: estimate-cost
         env:
           CODEX_HOME: .github/codex/home
-          MODEL: gpt-5.3-codex
+          MODEL: gpt-5.6-terra
           # Standard text-token rates per 1M tokens, sourced from:
-          # https://developers.openai.com/api/docs/models/gpt-5.3-codex
-          PRICE_INPUT_PER_M: "1.75"
-          PRICE_CACHED_INPUT_PER_M: "0.175"
-          PRICE_OUTPUT_PER_M: "14.0"
+          # https://developers.openai.com/api/docs/models/gpt-5.6-terra
+          PRICE_INPUT_PER_M: "2.0"
+          PRICE_CACHED_INPUT_PER_M: "0.2"
+          PRICE_OUTPUT_PER_M: "12.0"
         run: |
           set -euo pipefail
 
           echo "model=$MODEL" >> "$GITHUB_OUTPUT"
-          echo "price_source=https://developers.openai.com/api/docs/models/gpt-5.3-codex" >> "$GITHUB_OUTPUT"
+          echo "price_source=https://developers.openai.com/api/docs/models/gpt-5.6-terra" >> "$GITHUB_OUTPUT"
 
           SESSION_FILE=$(find "$CODEX_HOME" -type f -name '*.jsonl' -print 2>/dev/null | xargs ls -t 2>/dev/null | head -n1 || true)
           if [ -z "$SESSION_FILE" ]; then

.github/workflows/release.yml

@@ -28,5 +28,18 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Created tag: $TAG"
 
+      # `current` is a moving tag that always points at the latest release on
+      # main. Consumers reference `ai-review.yml@current` so they pick up new
+      # releases without a per-repo re-pin. To roll back every consumer at
+      # once, move the tag by hand to an older release:
+      #   git tag -f current 1.30.20260821 && git push -f origin current
+      # (the next merge to main moves it forward again).
+      - name: "🏷️ Move `current` tag"
+        run: |
+          set -euo pipefail
+          git tag -f current
+          git push -f origin current
+          echo "Moved tag: current -> $(git rev-parse --short HEAD)"
+
       - name: "📝 Write summary"
-        run: echo "Released tag \`${{ steps.tag.outputs.tag }}\`" >> "$GITHUB_STEP_SUMMARY"
+        run: echo "Released tag \`${{ steps.tag.outputs.tag }}\` (\`current\` now points here)" >> "$GITHUB_STEP_SUMMARY"

README.md

@@ -63,7 +63,7 @@ on:
 
 jobs:
   ai-review:
-    uses: jitsucom/github-workflows/.github/workflows/ai-review.yml@main
+    uses: jitsucom/github-workflows/.github/workflows/ai-review.yml@current
     secrets: inherit
     with:
       pr_number: ${{ inputs.pr_number }}
@@ -81,9 +81,22 @@ Use the `review_instructions` input to focus the review on what matters for your
         Skip style nitpicks.
 ```
 
-#### Updating
+#### Versioning
 
-All consuming repos pick up changes automatically on the next run — no changes needed per repo.
+Every merge to `main` is tagged `1.<commit-count>.<yyyymmdd>` by
+[`release.yml`](.github/workflows/release.yml), which also moves the `current` tag to the
+same commit.
+
+- `@current` (recommended) — consuming repos pick up each release automatically on the
+  next run; no per-repo re-pin.
+- `@1.30.20260821` — pin a specific release if a repo needs to opt out of updates.
+
+To roll back **all** `@current` consumers at once, move the tag to an older release
+(the next merge to `main` moves it forward again):
+
+```sh
+git tag -f current 1.30.20260821 && git push -f origin current
+```
 
 ## Composite actions