fix(ai-review): allow github-actions[bot] PRs to be reviewed

codex-action's write-access check queries the collaborators API, which
returns permission 'none' for the github-actions[bot] actor and aborts
the run with "Actor 'github-actions[bot]' is not permitted to run this
action". This blocked AI review on the automated security-fix PRs, which
are opened under the repo's own GITHUB_TOKEN (actor github-actions[bot]).

Pass allow-bots: true so codex-action whitelists the GitHub-owned
github-actions[bot] specifically. The review still posts via the
AI_CODE_REVIEW app token, which already has PR write — the actor check
was the only gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(ai-review): always approve PRs, surface findings as comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(contributing): clarify merge policy

"Avoid merge commits" meant don't merge default branch into feature
branches — always rebase. For PRs, merge commit is now the default
merge method and rebase-and-merge is also allowed. Squash stays off.

fix(ai-review): never request changes, only comment or approve

Drop REQUEST_CHANGES from the PR review verdict — branch protection now
gates merges by requiring all review threads to be resolved, so a COMMENT
is enough to make the author address a finding without the AI blocking
the merge itself.

fix(ai-review): only request changes for critical findings

Raise the bar for the REQUEST_CHANGES verdict so it fires only on new,
critical issues — real bugs, security holes, data loss, user-visible
regressions. Non-critical and uncertain findings now post as COMMENT
inline comments instead, so false positives no longer block PRs.

chore: add MIT LICENSE

This repo is public and intended to be reusable across jitsucom repos.
Without a LICENSE file it sits under default copyright (no grant), which
is inconsistent with that intent. MIT matches the rest of jitsucom's
permissive-licensed public repos.

chore: drop ruleset template (not committed; applied once locally)

feat(slack-notify): skip blocks with empty value

Lets callers conditionally include rows by resolving the value
expression to '' rather than constructing the YAML in a shell step.

Merge pull request #6 from jitsucom/feat/slack-bot-thread

feat(slack-notify): add bot-token path with thread + update support

Merge pull request #5 from jitsucom/feat/deploy-helpers

feat(actions): add slack-notify, install-yq, install-kustomize