Thread BEDROCK_ISSUE_MODEL_ID through the reusable workflow

v1.5 added the issue-answer model knob to the engine but did not wire it in the
reusable workflow, so a caller couldn't set it by secret (only via .shadow.yml).
Declare BEDROCK_ISSUE_MODEL_ID as an optional secret and pass it into the
analyze job's env, mirroring BEDROCK_CRITIC_MODEL_ID. Not added to the act job
(act only posts; the footer model id comes from the analyze artifact). Caller
example documents the new secret + its structured-output constraint.

Author: sudsali

.github/workflows/shadow-review.yml

@@ -74,6 +74,9 @@ on:
         required: false
       BEDROCK_CRITIC_MODEL_ID:
         required: false
+      BEDROCK_ISSUE_MODEL_ID:
+        required: false
+        description: "Model for issue/followup answers (defaults to the reporter model). Must support structured output over Bedrock (Haiku 4.5 / Sonnet 4.6)."
       GUARDRAIL_ID:
         required: false
       GUARDRAIL_VERSION:
@@ -155,6 +158,7 @@ jobs:
           BEDROCK_MODEL_ID: ${{ secrets.BEDROCK_MODEL_ID || 'us.anthropic.claude-opus-4-7' }}
           BEDROCK_REPORTER_MODEL_ID: ${{ secrets.BEDROCK_REPORTER_MODEL_ID || 'us.anthropic.claude-haiku-4-5-20251001-v1:0' }}
           BEDROCK_CRITIC_MODEL_ID: ${{ secrets.BEDROCK_CRITIC_MODEL_ID }}
+          BEDROCK_ISSUE_MODEL_ID: ${{ secrets.BEDROCK_ISSUE_MODEL_ID }}
           GUARDRAIL_ID: ${{ secrets.GUARDRAIL_ID }}
           GUARDRAIL_VERSION: ${{ secrets.GUARDRAIL_VERSION }}
           BOT_AGENT_PIPELINE: "1"

examples/caller-workflow.yml

@@ -77,6 +77,9 @@ jobs:
       # BEDROCK_MODEL_ID: ${{ secrets.BEDROCK_MODEL_ID }}
       # BEDROCK_REPORTER_MODEL_ID: ${{ secrets.BEDROCK_REPORTER_MODEL_ID }}
       # BEDROCK_CRITIC_MODEL_ID: ${{ secrets.BEDROCK_CRITIC_MODEL_ID }}
+      # Issue/followup answers (defaults to reporter). Must support structured
+      # output — Haiku 4.5 or Sonnet 4.6 (not Opus 4.8 / Sonnet 5).
+      # BEDROCK_ISSUE_MODEL_ID: ${{ secrets.BEDROCK_ISSUE_MODEL_ID }}
       # KB_S3_BUCKET: ${{ secrets.KB_S3_BUCKET }}
       # KB_S3_KEY: ${{ secrets.KB_S3_KEY }}
       # SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}