ci: pin Gemini reviewer to public-workflows v2.19.8 (ENG-7716)

[nsportsman]

Summary

• Pin this repo's Gemini PR-review caller to public-workflows v2.19.8 (7d5ab6d7, #171).
• Inherits gemini-3.8-flash (ENG-7646), Gemini CLI 0.58.0, size-aware turn cap, and fetch-graph (ENG-7656 / ENG-6428 / ENG-7654).
• Leave model unset so the reusable default applies.
• Grant actions: read when missing so fetch-graph can fail-open instead of permission-error.

Tracked by ENG-7716. Palatine (#930) and guard (#8361) already ship this pin.

Test plan

• uses: SHA is 7d5ab6d7c9288e7513e2995dc432a86e73ded955
• No with.model override
• actions: read is present on the caller job

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T00:34:07.662991Z	1c1eee5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Codex Review

No critical issues — LGTM pending human review.

---

Reviewed by Codex (gpt-5.5)

[github-actions]

Claude Review

Critical issues

None.

Security

• Reusable workflow is pinned to a full 40-char commit SHA (7d5ab6d7...), not a mutable tag — good supply-chain hygiene. The added actions: read is correctly scoped read-only for artifact download.

Test coverage

No production *.go/*.ts/*.py code changed; only a workflow permission/SHA pin. No tests needed.

All three test-plan items verify against the diff: uses: SHA is 7d5ab6d7c9288e7513e2995dc432a86e73ded955, no with.model override, and actions: read is present on the caller job.

No critical issues — LGTM pending human review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0d2389c0-61ba-4197-a5b2-6cc2aa7ddc54

📥 Commits

Reviewing files that changed from the base of the PR and between ae5082e and 1c1eee5.

📒 Files selected for processing (1)

• .github/workflows/gemini-code.yml

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

Walkthrough

The GitHub Actions workflow now uses public-workflows Gemini code workflow v2.19.8. The job permissions now include actions: read for graph artifact access.

Merge Risk: ⚪ Minimal · up to 1c1ee

The Gemini review workflow is updated to a pinned reusable-workflow version with read-only Actions access; no current merge-blocking risk is identified.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch eng-7716-pin-gemini-v2.19.8

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Gemini Review

Critical Issues

None.

Security

No security concerns flagged.

Suggestions

• Potential PIN Verification Fragility (.github/workflows/gemini-code.yml#L18): The newly added version comment contains a suffix after the version number: # v2.19.8 (ENG-7716). If the repository's verify-pins.yml workflow strictly parses the comment to map the commit SHA to an exact Git release tag (e.g., checking for # vX.Y.Z specifically), this suffix might cause the verification job to fail. Consider shortening the comment to # v2.19.8 to align with the format of all other workflows in the repo, unless the parser is confirmed to handle trailing metadata.

---

Reviewed by Gemini (gemini-3.8-flash)