docs: add BYOK code review workflow example

[markattar-factory]

Description

Adds a copyable GitHub Actions YAML example to the existing Automated Code Review page. The example configures an Anthropic custom model on a fresh runner, supplies its API key through Actions secrets, and selects custom:byok-review-0 for both review passes.

The surrounding instructions distinguish provider credentials from the Factory API key and GitHub App access. They explain the quoted heredoc, custom model ID, fork restrictions, and how to check whether the action falls back to an organization default.

Out of scope: new documentation pages, navigation changes, and changes to the action or this repository's active workflows.

Related Issue

Requested BYOK workflow example for the code review page. No issue ID provided.

Reviewer Guide

Read order: docs/guides/droid-exec/code-review.mdx, the new BYOK code review section immediately after Authentication.

Review depth: Standard. The copyable example's secret handling, model selection, and runner assumptions are the important checks. The remainder of the page is unchanged.

Risk & Impact

Documentation only; no runtime behavior changes. The example skips drafts and fork PRs and targets a fresh GitHub-hosted runner. It warns self-hosted users not to overwrite existing settings and explains that an invalid or policy-blocked model can trigger a fallback, so a successful action alone does not prove BYOK usage.

Verification

Behavior verified: The example's setup step runs in a temporary home with a dummy environment value. It writes valid JSON with permissions 0600, preserves the literal environment reference, and does not write the dummy value into settings.

Source verification: Action inputs, settings loading, custom model ID generation, review-pass wiring, and fallback behavior are checked against the action and CLI source.

Not tested: A live provider-backed review. Validation does not invoke an LLM or post review feedback.

Standard validators: Mintlify build validation passes with OpenAPI generation disabled; the page compiles as MDX, the extracted YAML passes actionlint, new internal links resolve, and git diff --check passes.

[factory-droid]

Droid finished @markattar-factory's task —— View job

---

The BYOK workflow is clear, but its credential-bearing action uses the mutable main branch while receiving sensitive credentials and write-capable permissions. Pin the action to a reviewed full commit SHA.

1 inline comment posted

[factory-droid]

[P1] [security] Pin the credential-bearing action to an immutable commit

Factory-AI/droid-action@main follows a mutable branch, so an upstream compromise or force-push can replace the code executed by every copied workflow. This step receives both API keys and runs with PR, issue, and OIDC permissions, enabling credential theft or token abuse; pin it to a reviewed full commit SHA.