ci: add AI security review on pull requests

Brings this starter to the same PR-review baseline as mcp-server-starter and python-mcp-server-starter, which were the only two of the eleven that had it. Byte-identical to the mcp-server-starter workflow.

The job gates on CLAUDE_API_KEY being present and emits a notice rather than failing when it is unset, so forks and repos freshly created from this template stay green without configuring a secret. Action pinned by commit SHA, bumped via the existing Dependabot actions group.

Author: heznpc

.github/workflows/claude-security-review.yml

@@ -0,0 +1,43 @@
+name: AI Security Review
+
+on:
+  pull_request:
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  ai-review:
+    runs-on: ubuntu-latest
+    steps:
+      # Gate the job on the secret being set so forks / fresh clones don't
+      # red-fail. The `secrets` context can't be used directly in `if:`, so we
+      # route through a step output. When CLAUDE_API_KEY is unset, the job
+      # emits a notice and skips the actual analysis steps.
+      - name: Check CLAUDE_API_KEY presence
+        id: gate
+        env:
+          API_KEY: ${{ secrets.CLAUDE_API_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${API_KEY:-}" ]; then
+            echo "::notice::CLAUDE_API_KEY secret is not set — skipping AI security review. Set the secret in repo settings to enable."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        if: steps.gate.outputs.skip == 'false'
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      # Pinned to a specific commit SHA. Bumped via Dependabot (group: actions).
+      - name: AI security review
+        if: steps.gate.outputs.skip == 'false'
+        uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}