ci: ask for another Louise review with the louise:review label

[bowenforsoup]

What changes

The Louise review caller adds labeled to its pull_request types, so the louise:review label asks for another review. The label exists in this repository now.

Merge order

Merge bowenlabs/claude-plugins#24 first. That pull request limits a pull request to two automatic reviews, moves the CI review to Sonnet, and ignores labels other than louise:review. Until it's on main, a labeled event here would start a review for any label.

This pull request is a draft so that opening it doesn't start a review on the current workflow. Mark it ready after #24 merges; that review then runs on Sonnet.

Testing

• actionlint 1.7.12: clean.

Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	astroidjs	0b03c8e	Oct 04 2026, 10:41 PM

[bowenlabs-louise-agent]

Verdict: Not ready to merge. The labeled trigger depends on claude-plugins#24, but this repository runs the pinned commit a199aa6, and the PR doesn't bump the pin. Merging #24 first doesn't change what runs here.

Findings

1. .github/workflows/louise-review.yml:21: the merge order in the PR body doesn't cover the pin. With the pin unchanged, any label starts a review.

Line 21 still pins @a199aa6387afd6b64548dd3dbdc1d5b206313357. At that commit the reusable workflow skips only drafts, pull requests from forks, and pull requests from other bots. It has no label filter and no cap on automatic reviews. Once this PR is out of draft:

• Every labeled event runs a full review with the Claude token, the Louise token, and the agent app key, including labels from changesets, Renovate, or agent:*.
• The cap of two automatic reviews doesn't apply.

That is the risk the PR body says merging #24 first avoids, and merging #24 doesn't avoid it.

• Fix: After claude-plugins#24 merges, change line 21 in this PR to chore(deps): louise-toolkit ^0.31.0, @louise-toolkit/astro ^0.2.2 #24's merge commit on claude-plugins' main, and keep the # main comment. Until then, keep the PR a draft. Adding if: github.event.action != 'labeled' || github.event.label.name == 'louise:review' to the review job would also close the gap whatever the pin is.
• Source: the pin rationale in this file, lines 18 to 20. The claude-plugins README, section "Review in CI," at the pinned commit: https://github.com/bowenlabs/claude-plugins/blob/a199aa6387afd6b64548dd3dbdc1d5b206313357/README.md#review-in-ci. Louise doesn't index claude-plugins#24 (trace returned nothing), so I couldn't confirm whether it has merged.

2. .github/workflows/louise-review.yml:2-3: the new header comment describes behavior the pinned workflow doesn't have.

"It reviews a pull request on its own at most twice; the louise:review label asks for another" describes #24. At a199aa6 the workflow reviews again on every push and treats all labels alike. The prose passes the style check; it is wrong for the code it ships with.

• Fix: Land the comment in the same change as the pin bump in finding 1.
• Source: the same README section at the pinned commit. Also astroidjs CLAUDE.md, "Decisions get an ADR": "A stale ADR is worse than none, because people trust it." That line is about ADRs, but it applies to a header that documents a security boundary.

Style (Vale)

No findings. .louise/vale.txt is empty.

Checked, nothing found

• Rules: The change adds no louise-toolkit dependency, doesn't touch template/, and changes no package, so it needs no scaffold smoke run and no changeset.
• Decisions: ADR 0025 (action pins) covers each site's generated release.yml, not this workflow, so it neither conflicts nor needs amending.
• Design: No UI files changed.

No other repository affected. The change depends on bowenlabs/claude-plugins#24 but doesn't change claude-plugins.