fix(dev-lead): resolve identity from persona manifest, not shared vars.BOT_USER (#1316)

[don-petry]

Fixes #1316.

Regression

dev-lead regressed to authoring/pushing commits as donpetry-bot — the review-only PR-review machine user — instead of don-petry. Git-archaeology dates the flip to late June 2026 (author id 36422719 don-petry → 281750570 donpetry-bot) with no code change in the window, so the trigger was the runtime vars.BOT_USER Actions variable: dev-lead and pr-review shared it, and setting it to donpetry-bot for pr-review's approvals flipped dev-lead's committer as collateral damage. (It also left the anti-loop sender == BOT_USER guard inconsistent, since the real pusher is don-petry.)

Fix — declarative, per-persona identity

• Manifests — personas/*/persona.yml gain runtime.identity (account + credential): dev-lead → don-petry, pr-review → donpetry-bot, advisory personas → don-petry.
• Runtime — scripts/lib/resolve-persona-identity.sh resolves BOT_USER from the manifest; dev-lead-reusable.yml and pr-review.yml consume it in a "Resolve persona identity" step. dev-lead's job-env fallback flips donpetry-bot → don-petry.
• Enforcement — validate-personas.py makes runtime.identity mandatory + enforces GH_PAT_<ACCOUNT> credential naming; new scripts/verify-persona-identity.sh (wired into lint.yml) asserts the manifest↔workflow wiring can't drift. +2 new validator tests.
• Credential rename sweep (clarity) — GH_PAT_WORKFLOWS → GH_PAT_DON_PETRY, GH_PAT → GH_PAT_DON_PETRY_COPILOT, applied with secrets.NEW || secrets.OLD transition fallbacks. Bot secrets (DON_PETRY_BOT_GH_PAT*) grandfathered.
• Docs — machine-user-setup.md, dev-lead/spec.md, AGENTS.md.

Requires

1. Merge the companion schema PR first: feat(personas): declarative runtime.identity for the persona standard .github#782 (same branch name, so this repo's validate-personas job validates against it).
2. Provision the new secrets (copies of the old values — fallbacks keep CI green until then): GH_PAT_DON_PETRY ← GH_PAT_WORKFLOWS, GH_PAT_DON_PETRY_COPILOT ← GH_PAT.

Verification

actionlint / markdownlint / shellcheck clean; persona validator (22 existing + 2 new) green; dev-lead intent/anti-loop tests green; resolver + drift-checker verified. The live proof is the next dev-lead commit being authored by don-petry.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Persona-based runtime identity is now resolved automatically for supported workflows.
  • Added consistency checks to verify persona identities, credentials, and workflow configuration.
  • Automation now supports the updated credential configuration while retaining compatibility with legacy settings.

• Bug Fixes

  • Improved authentication fallback handling across automated workflow operations.

• Documentation

  • Updated identity, credential naming, migration, and developer workflow documentation.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 41 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b3636121-6c90-4600-a1f7-405d9e80b77d

📥 Commits

Reviewing files that changed from the base of the PR and between 758efed and 53bd5ba.

📒 Files selected for processing (10)

• .github/workflows/dependency-advisory.yml
• .github/workflows/dev-lead-retry.yml
• .github/workflows/dev-lead-reusable.yml
• .github/workflows/lint.yml
• docs/dev-lead/spec.md
• docs/pr-review-agent/machine-user-setup.md
• personas/validate-personas.py
• scripts/lib/resolve-persona-identity.sh
• scripts/verify-persona-identity.sh
• tests/test_validate_personas.bats

📝 Walkthrough

Walkthrough

The change adds manifest-driven persona identities, validates credential naming and workflow wiring, and updates GitHub Actions to prefer account-specific PAT secrets with legacy fallbacks.

Changes

Persona identity and validation

Layer / File(s)	Summary
Identity declarations and contracts AGENTS.md, docs/..., personas/*/persona.yml, personas/validate-personas.py, tests/test_validate_personas.bats	Persona manifests declare runtime accounts and credentials; validator rules and tests enforce the identity contract.
Identity resolution and CI verification scripts/lib/resolve-persona-identity.sh, scripts/verify-persona-identity.sh, .github/workflows/lint.yml	New scripts resolve manifest identity and verify credential references, naming, and workflow usage.
Reusable agent identity wiring .github/workflows/dev-lead-reusable.yml, .github/workflows/pr-review.yml, .github/workflows/persona-runner-reusable.yml, .github/workflows/readme-refresh.yml	Reusable workflows add canonical PAT inputs, resolve BOT_USER from persona manifests, and apply Copilot PAT fallbacks.

PAT precedence across automation

Layer / File(s)

Summary

Workflow authentication fallback rollout .github/workflows/actions-fleet-monitor.yml, .github/workflows/auto-rebase-retry.yml, .github/workflows/dependency-advisory.yml, .github/workflows/dev-lead-retry.yml, .github/workflows/feature-ideation.yml, .github/workflows/gh-aw-cross-org.yml, .github/workflows/idea-triage.yml, .github/workflows/initiative-*.yml, .github/workflows/pr-review-*.yml, .github/workflows/reviewer-report.yml, .github/workflows/token-report.yml

Checkout, dispatch, reporting, triage, remediation, and analysis steps now prefer account-specific PAT secrets before existing fallbacks.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Workflow
  participant PersonaResolver
  participant PersonaManifest
  participant GitHub
  Workflow->>PersonaResolver: Resolve runtime identity
  PersonaResolver->>PersonaManifest: Read runtime.identity
  PersonaManifest-->>PersonaResolver: Return account and credential
  PersonaResolver-->>Workflow: Set BOT_USER and token inputs
  Workflow->>GitHub: Execute authenticated API operation

Loading

Possibly related PRs

• petry-projects/.github-private#100: Updates PR-review persona/runtime wiring and bot identity resolution.
• petry-projects/.github-private#179: Introduces the reusable dev-lead workflow flow extended here.
• petry-projects/.github-private#197: Adds fleet-monitor authentication wiring updated by this PAT precedence change.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR also includes broad secret renames, unrelated workflow updates, and new persona changes beyond the dev-lead identity fix in #1316.	Split the unrelated secret/credential, documentation, and other persona/workflow changes into separate PRs or justify them with linked issues.
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main dev-lead identity fix and matches issue #1316.
Linked Issues check	✅ Passed	The PR resolves dev-lead identity from persona manifests and adds validation/drift checks, addressing the issue's root cause and expected behavior.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/persona-identity-1316

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a mandatory runtime.identity block for all persona manifests to explicitly define the GitHub account and credential secret each persona acts as, preventing accidental fallbacks to shared machine users. It includes validation updates, helper scripts, and documentation. The review feedback focuses on improving robustness and performance: suggesting a pure Python fallback parser in resolve-persona-identity.sh to avoid PEP 668 pip installation failures, optimizing verify-persona-identity.sh by replacing external subshell calls inside loops with pure Bash parameter expansions, and adding defensive checks in validate-personas.py to prevent potential crashes during manifest parsing.

[Copilot]

Pull request overview

This PR addresses the dev-lead identity regression (#1316) by making agent/persona “acting identity” declarative in persona manifests and wiring workflows to resolve BOT_USER from those manifests instead of relying on a shared vars.BOT_USER.

Changes:

• Add mandatory runtime.identity (account + credential) to persona manifests and enforce it in validate-personas.py + Bats tests.
• Introduce identity resolution and drift checks (resolve-persona-identity.sh, verify-persona-identity.sh) and wire them into lint.yml and key workflows.
• Begin PAT secret rename migration (GH_PAT_WORKFLOWS → GH_PAT_DON_PETRY, GH_PAT → GH_PAT_DON_PETRY_COPILOT) with NEW || OLD fallbacks across workflows and docs.

Reviewed changes

Copilot reviewed 33 out of 33 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/test_validate_personas.bats	Adds validator tests for mandatory runtime.identity and credential naming.
scripts/verify-persona-identity.sh	New drift check tying persona identity ↔ workflow consumption.
scripts/lib/resolve-persona-identity.sh	New runtime resolver to read runtime.identity from persona YAML.
personas/validate-personas.py	Makes runtime.identity mandatory and adds credential convention checks.
personas/scrum-master/persona.yml	Adds runtime.identity for advisory persona.
personas/qa-lead/persona.yml	Replaces “no runtime block” doc with runtime.identity.
personas/pr-review/persona.yml	Declares pr-review acts as donpetry-bot + grandfathered credential.
personas/dev-lead/persona.yml	Declares dev-lead acts as don-petry + canonical credential.
personas/business-analyst/persona.yml	Adds runtime.identity for advisory persona.
docs/pr-review-agent/machine-user-setup.md	Documents new GH_PAT_<ACCOUNT> secret naming and migration.
docs/dev-lead/spec.md	Updates spec env examples for new secret names and identity model.
AGENTS.md	Documents the new manifest-driven identity standard and constraints.
.github/workflows/token-report.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/reviewer-report.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/readme-refresh.yml	Uses `GH_PAT_DON_PETRY_COPILOT
.github/workflows/pr-review.yml	Adds persona identity resolution step; updates Copilot PAT secret fallback.
.github/workflows/pr-review-sweep.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/pr-review-mention.yml	Maps reusable secret input from `GH_PAT_DON_PETRY
.github/workflows/pr-review-canary.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/persona-runner-reusable.yml	Adds optional GH_PAT_DON_PETRY secret and uses it as preferred GH_TOKEN.
.github/workflows/lint.yml	Adds verify-persona-identity job and updates PAT usage.
.github/workflows/initiative-planner.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/initiative-planner-canary.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/initiative-driver.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/initiative-driver-canary.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/idea-triage.yml	Updates cross-repo token fallback to prefer GH_PAT_DON_PETRY.
.github/workflows/gh-aw-cross-org.yml	Updates PAT fallbacks for checkout/auth and Copilot token rename.
.github/workflows/feature-ideation.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/dev-lead-reusable.yml	Adds persona identity resolution step; updates PAT fallbacks and sparse checkout.
.github/workflows/dev-lead-retry.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/dependency-advisory.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/auto-rebase-retry.yml	Switches to `GH_PAT_DON_PETRY
.github/workflows/actions-fleet-monitor.yml	Switches to `GH_PAT_DON_PETRY

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[coderabbitai]

Actionable comments posted: 8

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/feature-ideation.yml (1)

128-132: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Synchronize PAT diagnostics and documentation with donor-first selection.

The workflows now accept GH_PAT_DON_PETRY, but their guards/comments still identify GH_PAT_WORKFLOWS as the sole required or primary credential.

• .github/workflows/feature-ideation.yml#L128-L132: update the missing-secret error.
• .github/workflows/initiative-driver.yml#L91-L95: update the missing-secret error.
• .github/workflows/initiative-planner.yml#L102-L105: update the missing-secret error.
• .github/workflows/initiative-planner.yml#L143-L147: update the cross-repository and redispatch credential comments.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/feature-ideation.yml around lines 128 - 132, Synchronize
PAT diagnostics and documentation with donor-first selection: update the
missing-secret errors in .github/workflows/feature-ideation.yml lines 128-132,
.github/workflows/initiative-driver.yml lines 91-95, and
.github/workflows/initiative-planner.yml lines 102-105 to identify
GH_PAT_DON_PETRY as the preferred credential while acknowledging the
GH_PAT_WORKFLOWS fallback; update the cross-repository and redispatch credential
comments in .github/workflows/initiative-planner.yml lines 143-147 to reflect
the same donor-first order.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/actions-fleet-monitor.yml:
- Around line 83-87: Update the fleet-monitor workflow credential expressions so
GH_PAT_WORKFLOWS remains the primary value for GH_TOKEN, issue operations, and
remediation-related authentication. Use GH_PAT_DON_PETRY only as the permitted
fallback, and apply this ordering consistently at the referenced workflow
occurrences, including the Run fleet monitor environment.

In @.github/workflows/auto-rebase-retry.yml:
- Line 49: Update the GH_TOKEN fallback chain in the retry dispatch
configuration so secrets.GH_PAT_WORKFLOWS remains the first candidate, followed
by secrets.GH_PAT_DON_PETRY and github.token. Preserve the existing fallback
behavior while ensuring workflow_run retries use GH_PAT_WORKFLOWS when
available.

In @.github/workflows/dependency-advisory.yml:
- Around line 45-48: Disable credential persistence in both checkout steps by
adding persist-credentials: false under with for actions/checkout in
.github/workflows/dependency-advisory.yml lines 45-48 and
.github/workflows/dev-lead-retry.yml lines 48-51; no other workflow behavior
should change.

In @.github/workflows/dev-lead-reusable.yml:
- Line 129: Replace the fallback GH_TOKEN expressions with the strict
secrets.GH_PAT_WORKFLOWS value at .github/workflows/dev-lead-reusable.yml lines
129, 439, and 485; all three workflow sites must use only that secret.
- Around line 173-178: Remove the if/else fallback wrappers around
resolve-persona-identity.sh in .github/workflows/dev-lead-reusable.yml lines
173-178 and .github/workflows/pr-review.yml lines 227-232. Invoke the script
directly, export its resolved value to BOT_USER, and allow a non-zero exit
status to halt each job instead of using the existing fallback environment
value.
- Line 187: Replace every COPILOT_GITHUB_TOKEN fallback expression with
secrets.GH_PAT only in .github/workflows/dev-lead-reusable.yml at lines 187,
283, 302, 321, 340, 359, 376, and 393, and in .github/workflows/pr-review.yml at
line 147. Ensure each workflow uses the exact GH_PAT secret without any
fallback.

In `@docs/pr-review-agent/machine-user-setup.md`:
- Around line 121-124: Update the explanatory sentence in the PAT secret naming
guidance to add a verb linking “the ambiguity” to its outcome, while preserving
the existing account naming schema and issue reference.

In `@scripts/verify-persona-identity.sh`:
- Around line 27-29: Update GRANDFATHERED in scripts/verify-persona-identity.sh
to a Bash array, then adjust both iteration sites (including lines 41–45) to
iterate over the array with quoted expansions, eliminating SC2086 while
preserving the existing credential values and behavior.

---

Outside diff comments:
In @.github/workflows/feature-ideation.yml:
- Around line 128-132: Synchronize PAT diagnostics and documentation with
donor-first selection: update the missing-secret errors in
.github/workflows/feature-ideation.yml lines 128-132,
.github/workflows/initiative-driver.yml lines 91-95, and
.github/workflows/initiative-planner.yml lines 102-105 to identify
GH_PAT_DON_PETRY as the preferred credential while acknowledging the
GH_PAT_WORKFLOWS fallback; update the cross-repository and redispatch credential
comments in .github/workflows/initiative-planner.yml lines 143-147 to reflect
the same donor-first order.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 34867e3e-b80c-4490-9bb7-19af1c2b9076

📥 Commits

Reviewing files that changed from the base of the PR and between da83a79 and 758efed.

📒 Files selected for processing (36)

• .github/workflows/actions-fleet-monitor.yml
• .github/workflows/auto-rebase-retry.yml
• .github/workflows/dependency-advisory.yml
• .github/workflows/dev-lead-retry.yml
• .github/workflows/dev-lead-reusable.yml
• .github/workflows/feature-ideation.yml
• .github/workflows/gh-aw-cross-org.yml
• .github/workflows/idea-triage.yml
• .github/workflows/initiative-driver-canary.yml
• .github/workflows/initiative-driver.yml
• .github/workflows/initiative-planner-canary.yml
• .github/workflows/initiative-planner.yml
• .github/workflows/lint.yml
• .github/workflows/persona-runner-reusable.yml
• .github/workflows/pr-review-canary.yml
• .github/workflows/pr-review-mention.yml
• .github/workflows/pr-review-sweep.yml
• .github/workflows/pr-review.yml
• .github/workflows/readme-refresh.yml
• .github/workflows/reviewer-report.yml
• .github/workflows/token-report.yml
• AGENTS.md
• docs/dev-lead/spec.md
• docs/pr-review-agent/machine-user-setup.md
• personas/business-analyst/persona.yml
• personas/dev-lead/persona.yml
• personas/devops-lead/persona.yml
• personas/pr-review/persona.yml
• personas/qa-lead/persona.yml
• personas/scrum-master/persona.yml
• personas/security-lead/persona.yml
• personas/sre-lead/persona.yml
• personas/validate-personas.py
• scripts/lib/resolve-persona-identity.sh
• scripts/verify-persona-identity.sh
• tests/test_validate_personas.bats

[don-petry]

@coderabbitai resolve

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

Auto-dismissed (#617): coderabbitai[bot] CHANGES_REQUESTED on a superseded commit. The bot re-reviews the new head automatically — a valid concern will return as a fresh review.

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — waiting on PR blockers (intent: fix-reviews)

PR: #1317
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-19T01:20:25Z

[don-petry]

Traceability: fixes #1316; tracked under the post-rollout hardening Epic #1318 (top-priority item — root cause of the pr-review approval friction across the persona rollout).