Fix UCI AI review trigger for explicit review ask

[masih]

Adjust event triggers such that explicit asks for review are handled.

Tested and diagnosed here.

[cursor]

PR Summary

Low Risk
Changes only GitHub Actions triggers and UCI pin versions; no application or security-sensitive runtime code.

Overview
AI Review now listens for issue_comment, pull_request_review_comment, and pull_request_review events so an explicit ask for review (e.g. in a PR comment) can start the job, not only standard PR sync/open events.

A job-level guard skips issue_comment runs when the comment is on a plain issue (github.event.issue.pull_request != null), avoiding wasted runs on non-PR threads.

Both AI Assistant and AI Review reusable workflows are pinned from UCI v0.0.16 to v0.0.17 (1d50ef2…). AI Review also passes allowed-team: 'sei-protocol/sei-core' to match the assistant workflow’s access control.

^{Reviewed by Cursor Bugbot for commit d849a6d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Aug 14, 2026, 10:23 AM

[seidroid]

The workflow correctly adds comment/review triggers plus a guard for non-PR issue_comment events, but the new events run with secrets: inherit and write permissions in the base-repo context with no actor gate — unlike the repo's two other AI workflows — and the pull_request_review* triggers let this review-posting workflow re-trigger itself. Codex reported no material findings and Cursor returned nothing.

Findings: 1 blocking | 2 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.
• 1 blocking issue(s) flagged inline on specific lines.

Non-blocking

• No concurrency group on this workflow, so a burst of comments (or a comment landing during a synchronize run) now starts several full AI review runs in parallel on the same PR. A concurrency group keyed on github.event.issue.number || github.event.pull_request.number with cancel-in-progress: true would keep cost bounded now that the workflow is comment-triggered.
• 1 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[suggestion] This workflow's output is a submitted PR review with inline comments, so these two triggers let it re-trigger itself. GitHub's recursion guard only suppresses events authored by the default GITHUB_TOKEN; the review here is posted as seidroid[bot] (a GitHub App installation token), whose actions do fire pull_request_review: submitted and pull_request_review_comment: created. Unless uci/ai-review.yml drops bot senders at this pinned SHA, the first review posted will queue another run.

Adding github.event.sender.type != 'Bot' (or !endsWith(github.actor, '[bot]')) to the job if makes the loop impossible at this level rather than relying on the called workflow's filtering. Note that ai-assist.yml sharing these triggers is not evidence this is safe — it responds to mentions and does not produce reviews or review comments, so it cannot feed its own trigger the way this one can.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.47%. Comparing base (918d1bd) to head (d849a6d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3921      +/-   ##
==========================================
- Coverage   59.49%   58.47%   -1.02%     
==========================================
  Files        2325     2229      -96     
  Lines      198659   188027   -10632     
==========================================
- Hits       118190   109955    -8235     
+ Misses      69228    67671    -1557     
+ Partials    11241    10401     -840     

Flag	Coverage Δ
sei-db	70.41% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.
see 96 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ack