feat(code-review): add opt-in block_on_severity merge gate

[starknetdev]

Summary

Reviews are advisory in this workflow: the only exit 1 paths are a missing config file and a non-zero exit from the codex CLI. A [CRITICAL] finding is posted as a comment and the build stays green.

That's a reasonable default, but it's a regression for repos migrating off hand-rolled review jobs. game-components' inline jobs ended with:

if echo "$BODY" | grep -qE '\[(CRITICAL|HIGH)\]'; then
  echo "::error::Review found CRITICAL or HIGH severity issues"
  exit 1
fi

So its port (Provable-Games/game-components#122) silently trades "a CRITICAL blocks merge" for "a CRITICAL is a comment".

Adds block_on_severity (default false) so a caller can opt back in, without imposing a gate on the four SDK repos that are happy with advisory reviews.

Behavior

• Default false → no change for any existing caller. The step is if: always() && inputs.block_on_severity, so it doesn't even run unless opted in.
• true → the review job fails when /tmp/review.txt contains [CRITICAL] or [HIGH]. Applies to both reviewers.
• The gate runs after the comment upsert, so a blocking finding is always posted before the job goes red.
• Guards on a non-empty review file, so a review that errored or produced no output cannot block on its own — that stays the job of the existing "Fail on Codex runtime error" step.

Verification

Gate logic exercised against realistic reviewer output:

review output	result
[HIGH] src/a.ts:1 - bad	BLOCK
[CRITICAL] a:1 - boom	BLOCK
[MEDIUM] … / [LOW] …	pass
lgtm	pass
No review output was captured from Claude.	pass
empty file	pass
The word HIGH appears but not bracketed	pass

The last row is the one worth calling out: matching is on the bracketed severity token, so prose mentioning "high severity" doesn't trip the gate.

Parsed with js-yaml to confirm the step lands in claude-review and codex-review and nowhere else. npx yaml@2.8.1 valid passes.

After merge

Backward-compatible, so v1 should move forward again — callers pin @v1 and won't see the input until it does.

Note the ordering constraint: passing an input a reusable workflow doesn't declare is a hard workflow error, so game-components#122 cannot set block_on_severity: true until v1 includes this. I'll wire it up once the tag moves.

🤖 Generated with Claude Code

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.