chore(auto-rebase): pin caller to @auto-rebase/stable channel (was frozen @v2)

[don-petry]

What

Re-syncs this repo's .github/workflows/auto-rebase.yml caller stub from the canonical standards/workflows/auto-rebase.yml. The only functional change is the reusable pin:

- uses: ...auto-rebase-reusable.yml@v2
+ uses: ...auto-rebase-reusable.yml@auto-rebase/stable

plus corrected header guidance and documentation of the eligibility / ready_label inputs.

Why

This caller was pinned to the frozen @v2 tag (376a4fcb, 2026-05-19), which:

• predates the review-ready eligibility gate (feat(token-report): 2-decimal USD, cost-per-day chart, PR titles #465/fix(pr-review): count only non-converging review cycles; make escalation recoverable #468) — so this repo still runs the original unrestricted fan-out (verified: PR#744, no approval / no auto-rebase:ready label, was auto-updated on the 3 most recent runs); and
• violates the org standard, which requires callers to pin the centrally-advanced auto-rebase/stable channel and never a frozen @vX (see standards/ci-standards.md → Reusable workflow versioning).

Rollout interaction

Part of the auto-rebase review-ready rollout. Ordering is safe either way:

• Before auto-rebase/stable is promoted to the fixed reusable: this repo runs the current channel head — same unrestricted behavior as today, no regression.
• After promotion (channel → a commit with fix(auto-rebase): source predicate from reusable's own commit, not @v1 (restores review-ready gate) .github#528 + fix(pr-review): count only non-converging review cycles; make escalation recoverable #468): this repo automatically adopts the review-ready restriction, no further change needed.

Depends on combsmith/.github#528 (keystone tooling_ref fix) being merged and the channel promoted before the restriction takes effect here.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 53 minutes and 9 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 630982eb-007b-45dc-860e-53eb0753c7c6

📥 Commits

Reviewing files that changed from the base of the PR and between b612b91 and 89f9821.

📒 Files selected for processing (4)

• .github/workflows/auto-rebase.yml
• .github/workflows/test-dev-lead.yml
• AGENTS.md
• tests/dev-lead/integration/test_auto_rebase_stub.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/auto-rebase-pin-stable-channel

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-24T23:45:35Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 89f98215986fc9182d0221639687265f8cb92c0d
Review mode: triage-approved (single reviewer)

Summary

Repins the auto-rebase.yml caller stub from the frozen @v2 tag to the centrally-advanced @auto-rebase/stable channel, aligning it with the canonical org stub and ci-standards.md. Matching, consistent updates to the regression test (test_auto_rebase_stub.py EXPECTED_REF), its CI step name, and the AGENTS.md exception note. One functional line; the rest are docs/test. Brings the caller into org-standard compliance rather than violating it.

Linked issue analysis

No issue is closed by this PR (closingIssuesReferences empty). It references #465/#468/#528 as rollout context and #139 as the test that enforces the pin; all are context, not closure targets. Not a blocker.

Findings

No blocking findings.

• The single functional change (@v2 -> @auto-rebase/stable) targets a same-org first-party reusable. SHA-pinning is explicitly exempted for first-party reusables (AGENTS.md), and the moving channel tag is the mandated standard; this is by design, not a supply-chain smell.
• All four files are mutually consistent (workflow ref, test EXPECTED_REF + endswith guard, step name, AGENTS.md note); the CI auto-rebase-stub job passed against the head SHA, confirming the test enforces the new ref.
• GitHub Secret Protection MCP (run_secret_scanning) not exposed in this environment; gitleaks CI check passed and the diff contains no secret material.
• Advisory reviewers (CodeRabbit, Codex, Gemini) were rate-limited or unsupported, but hard security gates (CodeQL actions+python, gitleaks, AgentShield, SonarCloud) all passed.

CI status

All checks green. SUCCESS: CodeQL (actions+python), Secret scan (gitleaks), AgentShield, SonarCloud, shellcheck/bats, unit-tests, validate-fixtures, auto-rebase-stub, and all Test Dev-Lead jobs. SKIPPED (n/a): dependabot-automerge, npm/pnpm/pip/cargo/govulncheck audits, dev-lead ci-relay. No failing checks. mergeStateStatus BLOCKED only because the org-leads team review is still required.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.