feat: ACNA-4515 add pr-reviewer workflow

[chsrimanaswi]

Description

Adds an AI-powered PR reviewer workflow that automatically reviews pull requests using Claude via AWS Bedrock. Triggers on PR open/reopen/synchronize and on /review or /pr-reviewer comments by admins or maintainers.

Related Issue

ACNA-4515

Motivation and Context

Reduces code review toil by providing automated first-pass reviews with inline suggestions. Part of a broader rollout across App Builder repos.

How Has This Been Tested?

Tested end-to-end in adobe/generator-aio-app — workflow triggers correctly on PR events and /review comments, posts inline suggestions and summary reviews via github-actions[bot].

Screenshots (if appropriate):

N/A

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA.
• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[github-actions]

🤖 PR Reviewer

The workflow is well-structured with clear gate logic and good security practices (permission checks, fork exclusion, env var injection). Two minor issues worth addressing: the gh api call for PR data is unquoted in a command substitution context which could cause word-splitting issues, and pinning the reusable workflow to @main is a supply-chain risk.

📝 3 suggestion(s) - Please review inline comments below.

---

💡 How to re-trigger

Comment /review or /pr-reviewer on this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Proposed changes not required

[github-actions]

🤖 PR Reviewer

The workflow is generally well-structured with good security practices like using environment variables instead of inline expressions in shell scripts. However, three issues from the previous review remain unaddressed: the DATA variable approach, defensive quoting, and the @main pin for the reusable workflow which is a supply-chain security risk.

🔄 3 re-raised suggestion(s) from previous review

---

💡 How to re-trigger

Comment /review or /pr-reviewer on this PR

proposed changes not required