[soheimam]

What changed? Why?

Adds an advisory AI reviewer for docs PRs from base-devrel and base-eng members.

• It posts one review comment covering fit (is the page live, not redirected, next to the right neighbor pages, do links resolve) and writing quality against the Base guidelines.
• Optional one-click suggestions are posted only when they add no new links, addresses, numbers, or code.
• It sets one risk: low|medium|high|critical label using fixed rules from the review ladder proposal. No AI is involved in the label. Shadow mode: nothing is enforced.
• It never pushes, approves, requests changes, or merges, and it is not a required check.

Two workflows:

• docs-pr-review-trigger.yml runs on pull_request on ubuntu-latest with no secrets and no permissions. It only starts stage 2.
• docs-pr-review.yml runs on workflow_run from the default branch on BaseRunnerGroup. It rejects forks, re-checks the PR through the API, checks team membership, and then makes one LLM Gateway call through the existing scripts/sync-from-base-std client.

Notes to reviewers

• Security review: SPA-35356, approved (Self-served). Findings SECREQ-7592 and SECREQ-7593 are fixed in this code.
• Runner and Gateway access reuse the existing approvals (SPA-26751, infra/entry-gateway#6123), the same as base-std-docs-sync.yml.
• Changes .github/workflows/, so the CI Configuration gate needs 3 writer approvals.
• Merging adds no running job until the workflows are on master, because workflow_run only runs from the default branch.

Before merge:

• Fork PR workflow approval set to "Require approval for all external contributors"
• Add the DOCS_PR_REVIEW_MEMBERS_TOKEN secret (org Members: read only)
• Create the skip-ai-review label and the four risk: low, risk: medium, risk: high, risk: critical labels

Turn off for everyone with the repository variable DISABLE_DOCS_PR_REVIEW=true, or for one PR with the skip-ai-review label.

How has it been tested?

• 45 of 45 unit tests pass against current master (node --test scripts/docs-pr-review/__tests__/*.test.mjs).
• When a PR changes docs/docs.json, page placement and link checks use the PR's copy, so a page added together with its menu entry is not reported as orphaned. A test covers this.
• Dry runs on recent PRs, including docs(base-verify): add base mainnet identity attestation options #2141 (risk: low) and docs(connecting-to-base): point production users to running a node #2086 (flagged an edit on a redirected page and named the live page instead).
• Risk levels on the last 60 merged PRs: 20% low, 42% medium, 33% high, 5% critical.

Source and security doc: cb-pages/devrel-ai-cc PR #29.

Screenshots

N/A (no user-facing changes)

Generated with Toshi

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[linear]

DEVREL-828