wip: chore: Integrate custom cr-agent

.cr-agent/prompt.md

@@ -0,0 +1 @@
+This is the dd-sdk-ios repository. Pay attention to Swift-specific concerns: ARC ownership, Swift concurrency, and main-thread requirements for UIKit code.

.cr-agent/run.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# -----------------------------------------------------------
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
+# This product includes software developed at Datadog (https://www.datadoghq.com/).
+# Copyright 2019-Present Datadog, Inc.
+# -----------------------------------------------------------
+#
+# Entry point for the `Code Review` CI job.
+# Clones rum-ai-toolkit, mints a short-lived GitHub token via dd-octo-sts,
+# then hands off to the toolkit's `review.sh` which runs the `cr-agent`.
+
+set -eo pipefail
+
+# TODO: switch toolkit ref to `main` before merging to develop.
+TOOLKIT_REF="ncreated/feat/cr-agent"
+TOOLKIT_DIR="$CI_PROJECT_DIR/.rum-ai-toolkit"
+
+echo "▸ Cloning rum-ai-toolkit ($TOOLKIT_REF)..."
+git clone --depth 1 --branch "$TOOLKIT_REF" \
+    "git@github.com:DataDog/rum-ai-toolkit.git" "$TOOLKIT_DIR"
+
+echo "▸ Installing cr-agent venv..."
+make -C "$TOOLKIT_DIR/tools/cr-agent" install
+
+echo "▸ Minting GitHub token via dd-octo-sts (policy: self.cr-agent)..."
+GITHUB_TOKEN=$(dd-octo-sts --disable-tracing token --scope DataDog/dd-sdk-ios --policy self.cr-agent)
+export GITHUB_TOKEN
+trap 'dd-octo-sts --disable-tracing revoke' EXIT
+
+echo "▸ Handing off to review.sh..."
+exec "$TOOLKIT_DIR/tools/cr-agent/review.sh"

.gitignore

@@ -30,3 +30,7 @@ artifacts/
 
 # GSD planning files (local only)
 .planning/
+
+# RUM AI Toolkit:
+.rum-ai-toolkit/
+.cr-agent/sessions/

.gitlab-ci.yml

@@ -121,14 +121,30 @@ Build Dependencies:
 
 Lint:
   stage: lint
-  rules: 
+  rules:
     - !reference [.test-pipeline-job, rules]
     - !reference [.benchmark-pipeline-job, rules]
   script:
     - make clean repo-setup ENV=ci
     - make lint license-check
     - make rum-models-verify sr-models-verify
 
+Code Review:
+  stage: lint
+  allow_failure: true
+  rules:
+    - if: '$CI_COMMIT_BRANCH != $DEVELOP_BRANCH && $CI_COMMIT_BRANCH != $MAIN_BRANCH'
+  id_tokens:
+    <<: *dd-octo-sts-id-token
+  artifacts:
+    paths:
+      - .cr-agent/sessions/
+    when: always
+    expire_in: 1 week
+  script:
+    - ./tools/runner-setup.sh --ssh
+    - ./.cr-agent/run.sh
+
 API Surface Verify:
   stage: lint
   rules: