Add canonical shared-rules mechanism to claude-review-toolkit

[marcochavezf]

Details

The code-inline-reviewer agent used by Auth's, Web-Expensify's, and App's claude-review.yml workflows loads its coding-standards rules from each repo's own committed .claude/skills/coding-standards/rules/ directory. A repo-agnostic rule like GEN-04 (commenting why) has already drifted into three different versions: Auth's copy uses curly quotes, Web-Expensify's copy is named differently and uses straight quotes, and App has no GEN-04 at all.

This adds a shared-rules/ directory to claude-review-toolkit holding the canonical version of rules that are genuinely identical across repos (currently just GEN-04). A new "Copy shared coding-standards rules" step in action.yml copies each shared rule file into the caller's .claude/skills/coding-standards/rules/ directory as AutoLoadShared-<file>.md before the existing "Extract allowed rules" step runs, so it reaches every caller's real PR review with no per-repo commit to keep in sync. The copy happens fresh in the ephemeral workflow checkout on every run and is never committed to the caller repo.

Follow-up PRs in Auth, Web-Expensify, and App will bump their pinned claude-review-toolkit@<sha> reference to this commit, delete their now-redundant local GEN-04 copy, and update code-inline-reviewer.md's docs-link generation to point a shared rule's link at this repo instead of the caller's own repo.

Related Issues

https://github.com/Expensify/Expensify/issues/657167

Manual Tests

Simulated the new action step locally: created a test workspace with an existing local rule file, ran the copy loop against shared-rules/gen-04-commenting-why.md, then ran extractAllowedRules.sh against the result and confirmed it extracts both GEN-01 (local) and GEN-04 (shared) with no duplicates. Confirmed the copied file is byte-identical to Auth's current gen-04-commenting-why.md (diff against the live Auth file on GitHub shows no differences).

Linked PRs

None yet. Auth, Web-Expensify, and App consumer PRs will be linked here once opened, after this PR merges and its commit SHA is known.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e21ca3e8a1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the missing-rules-directory failure

For a caller whose checkout or repo layout does not provide .claude/skills/coding-standards/rules, this mkdir -p creates the directory before extractAllowedRules.sh runs, so the documented guard that should fail on a missing caller rules directory is bypassed and the workflow can continue with only the shared GEN-04 rule. Keep the existence check before creating/copying shared files, or fail if the caller directory was absent, so misconfigured repos do not silently lose their repo-specific review rules.

Useful? React with 👍 / 👎.