Honor storage.compression on upgraded databases, and let a deployment select the codec #3450

	name: Validate caller workflows

	# Thin caller of HarperFast/ai-review-prompts'
	# `_validate-caller-workflows.yml`. Validates
	# `.github/workflows/claude-*.yml` caller files for:
	#
	# * Shadow jobs — a non-`uses:` job (or a `uses:` outside
	# `HarperFast/`) alongside the legit reusable call would run
	# with the caller's permissions WITHOUT going through the auth
	# gate. Fail-closed.
	# * Mutable refs in `uses:` or `with.ai-review-prompts-ref` —
	# both must pin to a 40-char SHA.
	#
	# Runs on every PR and every push to `main` — no `paths:` filter.
	# A required status check that only fires on workflow-touching PRs
	# stays permanently pending on every other PR (GitHub has no
	# "required if it runs" semantic). The validator's runtime is
	# trivial (yq-parses a few caller files), so unconditional firing
	# is the right trade-off for satisfiability.
	#
	# Make this `validate` job a REQUIRED status check on `main`.

	on:
	pull_request:
	push:
	branches: [main]

	jobs:
	validate:
	uses: HarperFast/ai-review-prompts/.github/workflows/_validate-caller-workflows.yml@82c9484f6f2560be4a37032858311e429bccd56c # main 2026-07-21 (#74: validator now covers gemini-*.{yml,yaml} callers too)
	with:
	# Same SHA as the `uses:` ref above — the reusable uses this
	# to check out the validator script at the matching version.
	# Same SHA-twice pattern as the other caller workflows.
	ai-review-prompts-ref: 82c9484f6f2560be4a37032858311e429bccd56c

Provide feedback