chore(workflows): OmniRoute safe audit normalization (r3)

[KooshaPari]

User description

Summary

• Audit-normalized 1 workflow files in OmniRoute (round 3).
• All files parse-validated; no placeholder SHA refs.

Test plan

• YAML parsed locally for each touched file
• SHA refs verified against target repositories
• CI unavailable due to account Actions billing constraint

Generated with Claude Code

---

Note

Low Risk
Cosmetic workflow reordering plus an equivalent default token reference; no change to lock logic or permissions model.

Overview
Restructures lock-released-branch.yml so triggers and metadata follow a consistent order: on: (release published, release/v* pushes, manual tag input) sits near the top, with the Hard Rule #18 comment block moved below concurrency instead of splitting the trigger section.

Updates the preventive guard job (guard-no-push-after-release) to authenticate GitHub API tag checks with ${{ github.token }} instead of ${{ secrets.GITHUB_TOKEN }} — same default token, aligned with common Actions conventions. Branch-lock behavior and job conditions are unchanged.

^{Reviewed by Cursor Bugbot for commit d5a23e0. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Keep release branch locking workflow ordered and reliable

What Changed

• Reordered the release-lock workflow so its triggers and notes are grouped clearly at the top
• Kept the release publish and release branch push checks in place to lock shipped branches and reject late pushes
• Switched the push guard to use the standard built-in GitHub token reference, with the same behavior

Impact

✅ Clearer release-branch protection
✅ Fewer workflow setup issues
✅ Safer detection of post-release pushes

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codeant-ai]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[coderabbitai]

Warning

Review limit reached

@KooshaPari, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 51 minutes and 44 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b3a2d4bf-8d35-433d-bfe8-12d1cf77042f

📥 Commits

Reviewing files that changed from the base of the PR and between 9b73a5d and d5a23e0.

📒 Files selected for processing (1)

• .github/workflows/lock-released-branch.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/audit-safe-workflows-0605-r3

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch chore/audit-safe-workflows-0605-r3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codeant-ai]

CodeAnt AI finished reviewing your PR.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Already Merged

Overview

This PR was already merged. It contains cosmetic workflow reordering and a token reference update.

Changes made:

• Moved on: triggers section to lines 3-14 (standard GitHub Actions ordering)
• Removed duplicate on: triggers that were previously at lines 40-50
• Changed ${{ secrets.GITHUB_TOKEN }} to ${{ github.token }} on line 108 (modern syntax)

Quality Assessment

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Notes:

• ${{ github.token }} is the preferred modern syntax over ${{ secrets.GITHUB_TOKEN }} - both reference the same auto-generated token, but the newer form is more idiomatic and slightly safer (immune to explicit secret deletion)
• No functional changes to lock logic, permissions, or error handling
• Workflow reordering improves readability by placing triggers near the top per standard conventions
• YAML structure is valid and properly formatted

Files Reviewed (1 file)

• .github/workflows/lock-released-branch.yml - No issues (cosmetic reordering + token syntax update)

---

_{Reviewed by laguna-m.1-20260312:free · 330,620 tokens}