chore(ci): track ai-workflows @v3 floating tag

[wezell]

This PR fixes #36285

What

Pin the ai-workflows orchestrator to the floating major tag @v3 (currently v3.1.6) instead of an exact patch tag, across all 4 references in 3 workflows. Consumers now auto-pick up v3.x releases without a per-release bump PR.

Why @v3 and not @main/SHA

The Bedrock OIDC trust (GitHubActions-BedrockCodeReview, IaC #7833) requires job_workflow_ref to match refs/tags/*. A branch or commit SHA is denied at configure-aws-credentials (AssumeRoleWithWebIdentity fails). @v3 is a tag (refs/tags/v3), so it satisfies the trust while still floating to the latest v3.x.

What v3.1.6 brings

Configurable max_output_tokens orchestrator input and the bedrock-generic default raised 2048 -> 32000. Core routes us.deepseek.r1-v1:0 (a reasoning model) through that path, where reasoning tokens count against the same budget — the old 2048 cap truncated reviews mid-thought. Completes the budget side of the R1 reviewer upgrade in #36285.

Files

• .github/workflows/ai_claude-rollback-safety.yml
• .github/workflows/ai_claude-orchestrator.yml (2 refs)
• .github/workflows/ai_claude-backend-reviewer.yml

Validation

v3.1.6 was validated end-to-end against the real DeepSeek R1 model in dotCMS/steve-quarterly-planning #109 (now closed): correct routing to the bedrock-generic path, sticky comment posted, all planted bugs caught, maxTokens=32000 accepted by R1 with no truncation.

Release: https://github.com/dotCMS/ai-workflows/releases/tag/v3.1.6

🤖 Generated with Claude Code

[github-actions]

🤖 Bedrock Review — us.deepseek.r1-v1:0

No issues found.

---

_{Run: #28059229727 · tokens: in: 1772 · out: 593 · total: 2365}

[github-actions]

🤖 Bedrock Review — us.deepseek.r1-v1:0

New Issues

• 🟡 Medium: .github/workflows/ai_claude-backend-reviewer.yml:88, .github/workflows/ai_claude-orchestrator.yml:85, .github/workflows/ai_claude-orchestrator.yml:171, .github/workflows/ai_claude-rollback-safety.yml:89 — Pinned GitHub Action reference changed from specific version v3.1.5 to floating v3 tag. While valid syntax, this increases risk of unintended behavior changes if the v3 tag is updated in the future to a breaking change, as workflows would automatically inherit the new version without explicit review.

---

_{Run: #28059764066 · tokens: in: 1769 · out: 741 · total: 2510}

[sfreudenthaler]

like the new floating tag. will also keep minting specific version tags / releases in ai-workflows repo.

good to go

[mergify]

Queued — the merge queue status continues in this comment ↓.

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-06-23 22:17 UTC · Rule: default · triggered by the @mergifyio queue command
• ✅ Checks skipped · PR is already up-to-date
• 🚫 Left the queue — 2026-06-23 22:17 UTC · at db569637ecd7d077bb5ee738f49970f5d6493b9a

This pull request spent 18 seconds in the queue, including 3 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • chore(ci): track ai-workflows @v3 floating tag #36296
• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • chore(ci): track ai-workflows @v3 floating tag #36296
• github-review-decision = APPROVED [🛡 GitHub branch protection]
  • chore(ci): track ai-workflows @v3 floating tag #36296
• any of [🛡 GitHub branch protection]:
  • check-success = Finalize / Final Status
  • check-neutral = Finalize / Final Status
  • check-skipped = Finalize / Final Status
• any of [🛡 GitHub branch protection]:
  • check-success = Initialize / Initialize
  • check-neutral = Initialize / Initialize
  • check-skipped = Initialize / Initialize

Reason

Pull request #36296 has been dequeued

GitHub refused to merge the pull request. Pull Request is in the merge queue. This is usually enforced by a branch protection or ruleset rule.

Hint

You should look at the reason for the failure and decide if the pull request needs to be fixed or if you want to requeue it.
If you do update this pull request, it will automatically be requeued once the queue conditions match again.
If you think this was a flaky issue instead, you can requeue the pull request, without updating it, by posting a @mergifyio queue comment.

Tick the box to put this pull request back in the merge queue (same as @mergifyio queue).

• Requeue this pull request