From 0f03dc56fecd86d5aabac2810779736b74a08208 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 21 Jul 2026 17:35:07 -0500 Subject: [PATCH 1/3] chore: sync 1 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/pr-auto-review.yml | 58 ++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 .github/workflows/pr-auto-review.yml diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml new file mode 100644 index 000000000..5dcd84d69 --- /dev/null +++ b/.github/workflows/pr-auto-review.yml @@ -0,0 +1,58 @@ +# ───────────────────────────────────────────────────────────────────────────── +# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/pr-auto-review.yml +# Standard: petry-projects/.github/standards/ci-standards.md +# Reusable: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml +# +# AGENTS — READ BEFORE EDITING: +# • This file is a THIN CALLER STUB. All readiness-gate logic lives in the +# reusable workflow above. +# • You MAY change: the workflow name(s) in `workflow_run.workflows` to match +# your repository's CI workflow name(s). +# • You MUST NOT change: the `@pr-auto-review/stable` channel in the `uses:` +# line — this reusable is on the org-wide moving-channel model (rollout and +# rollback are a single central tag move; a frozen `@vN`/`@` pin is +# rejected by the compliance audit). Nor the trigger event types or the +# job-level `permissions:` block — reusable workflows can be granted no more +# permissions than the calling job, so removing the stanza breaks the +# reusable's gh API calls. +# • If you need different behaviour, open a PR against the reusable in the +# central repo. The change will propagate everywhere on next run. +# ───────────────────────────────────────────────────────────────────────────── +# +# PR Auto-Review — thin caller for the org-level reusable. +# To adopt: copy this file to .github/workflows/pr-auto-review.yml in your repo. +# Requires: GH_PAT_WORKFLOWS org secret (already present in petry-projects org). +name: PR Auto-Review — Ready Check + +on: + # workflow_run fires when a named GitHub Actions workflow completes. + # check_suite does NOT trigger for GitHub Actions runs, so this is required + # to catch CI turning green on a PR. + # TODO: replace "CI" with your repository's CI workflow name(s). + workflow_run: + workflows: ["CI"] + types: [completed] + # check_suite covers third-party CI checks (e.g. SonarCloud, external apps). + check_suite: + types: [completed] + # Re-evaluate readiness after review state changes. + pull_request_review: + types: [submitted, dismissed] + # Re-evaluate when the PR is first opened, updated, or comes out of draft. + pull_request: + types: [opened, reopened, synchronize, ready_for_review] + +permissions: {} + +jobs: + pr-auto-review: + permissions: + pull-requests: read + checks: read + actions: read + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-next # NOSONAR(githubactions:S7637) first-party channel ref + secrets: + # Canonical-first fallback (.github-private#1326). The reusable resolves this + # secret BY NAME, so only the VALUE changes — the passed key stays named + # GH_PAT_WORKFLOWS. + GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }} From 00f7591770c6bc2586a712b06820f4118c15f37e Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 21 Jul 2026 22:37:08 +0000 Subject: [PATCH 2/3] chore: dev-lead update (review-changes) [skip ci-relay] --- sonar-project.properties | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sonar-project.properties b/sonar-project.properties index 3e0b1f1cc..06ab7fb14 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -13,7 +13,7 @@ sonar.exclusions=_bmad/**,_bmad-output/**,.claude/**,.github/workflows/**,tests/ # file individually; ci.yml / sonarcloud.yml and any third-party `uses:` keep # full SHA-pin enforcement — do NOT replace these with a blanket # `workflows/*.yml` resourceKey. -sonar.issue.ignore.multicriteria=s7637_agentshield,s7637_prreviewmention,s7637_autorebase,s7637_dependabotautomerge,s7637_dependencyaudit,s7637_featureideation,s7637_addtoproject,s7637_devlead +sonar.issue.ignore.multicriteria=s7637_agentshield,s7637_prreviewmention,s7637_prautoreview,s7637_autorebase,s7637_dependabotautomerge,s7637_dependencyaudit,s7637_featureideation,s7637_addtoproject,s7637_devlead sonar.issue.ignore.multicriteria.s7637_agentshield.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_agentshield.resourceKey=**/agent-shield.yml @@ -21,6 +21,9 @@ sonar.issue.ignore.multicriteria.s7637_agentshield.resourceKey=**/agent-shield.y sonar.issue.ignore.multicriteria.s7637_prreviewmention.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_prreviewmention.resourceKey=**/pr-review-mention.yml +sonar.issue.ignore.multicriteria.s7637_prautoreview.ruleKey=githubactions:S7637 +sonar.issue.ignore.multicriteria.s7637_prautoreview.resourceKey=**/pr-auto-review.yml + sonar.issue.ignore.multicriteria.s7637_autorebase.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_autorebase.resourceKey=**/auto-rebase.yml From 7297212866b43188e231f4c4c006b693856bfb1e Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 21 Jul 2026 17:37:16 -0500 Subject: [PATCH 3/3] chore(sonar): add S7637 exemption for pr-auto-review.yml caller stub (#847/#848 opt-in) --- sonar-project.properties | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sonar-project.properties b/sonar-project.properties index 06ab7fb14..3f74053fe 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -13,7 +13,7 @@ sonar.exclusions=_bmad/**,_bmad-output/**,.claude/**,.github/workflows/**,tests/ # file individually; ci.yml / sonarcloud.yml and any third-party `uses:` keep # full SHA-pin enforcement — do NOT replace these with a blanket # `workflows/*.yml` resourceKey. -sonar.issue.ignore.multicriteria=s7637_agentshield,s7637_prreviewmention,s7637_prautoreview,s7637_autorebase,s7637_dependabotautomerge,s7637_dependencyaudit,s7637_featureideation,s7637_addtoproject,s7637_devlead +sonar.issue.ignore.multicriteria=s7637_agentshield,s7637_prreviewmention,s7637_autorebase,s7637_dependabotautomerge,s7637_dependencyaudit,s7637_featureideation,s7637_addtoproject,s7637_devlead,s7637_prautoreview sonar.issue.ignore.multicriteria.s7637_agentshield.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_agentshield.resourceKey=**/agent-shield.yml @@ -21,9 +21,6 @@ sonar.issue.ignore.multicriteria.s7637_agentshield.resourceKey=**/agent-shield.y sonar.issue.ignore.multicriteria.s7637_prreviewmention.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_prreviewmention.resourceKey=**/pr-review-mention.yml -sonar.issue.ignore.multicriteria.s7637_prautoreview.ruleKey=githubactions:S7637 -sonar.issue.ignore.multicriteria.s7637_prautoreview.resourceKey=**/pr-auto-review.yml - sonar.issue.ignore.multicriteria.s7637_autorebase.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_autorebase.resourceKey=**/auto-rebase.yml @@ -41,3 +38,6 @@ sonar.issue.ignore.multicriteria.s7637_addtoproject.resourceKey=**/add-to-projec sonar.issue.ignore.multicriteria.s7637_devlead.ruleKey=githubactions:S7637 sonar.issue.ignore.multicriteria.s7637_devlead.resourceKey=**/dev-lead.yml + +sonar.issue.ignore.multicriteria.s7637_prautoreview.ruleKey=githubactions:S7637 +sonar.issue.ignore.multicriteria.s7637_prautoreview.resourceKey=**/pr-auto-review.yml