[don-petry]

Two fixes:

1. statuses: read — required by the reusable workflow since [Fleet Monitor] petry-projects/ContentTwin — .github/workflows/dev-lead.yml #435; without it the @main-pinned caller fails with startup_failure.
2. Remove the per-repo concurrency block — the repo-wide 'dev-lead' group cancelled issue pickups (7/7 issues-event runs cancelled). Concurrency is now centralised in dev-lead-reusable.yml with per-issue/per-PR lanes (fix(dev-lead): per-issue/per-PR concurrency lanes so issue pickups aren't cancelled .github-private#450).

Stuck PR to re-trigger after merge: #230. Refs combsmith/.github#402.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 27 minutes and 22 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d5009b27-aaa7-472a-84dc-fada4b1d2768

📥 Commits

Reviewing files that changed from the base of the PR and between 86ee81b and 357d96c.

📒 Files selected for processing (1)

• .github/workflows/dev-lead.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dev-lead-align

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[Copilot]

Pull request overview

This PR updates the dev-lead workflow stub to align with the reusable workflow’s current permission requirements and to avoid repository-wide concurrency behavior that was cancelling issues-event pickups. The intent is to keep concurrency logic centralized in dev-lead-reusable.yml while ensuring the caller grants the permissions the reusable workflow now needs.

Changes:

• Removed the repo-local concurrency: block from .github/workflows/dev-lead.yml so concurrency is controlled centrally by the reusable workflow.
• Added statuses: read to the calling job’s permissions to satisfy the reusable workflow’s requirements (per PR description / referenced change since #435).
• Added an inline comment explaining the concurrency centralization rationale and reference.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 357d96c7c1b3bf2071163cac3127050e2a7911aa
Review mode: triage-approved (single reviewer)

Summary

This is a small, contained CI/CD alignment fix to .github/workflows/dev-lead.yml (+4 / -9, single file):

1. Grants statuses: read to the caller — the read-only permission the reusable dev-lead-reusable.yml has required since #435; without it the @main-pinned caller fails with startup_failure.
2. Removes the repo-local concurrency: block, since concurrency is now centralised in the reusable workflow with per-issue / per-PR lanes (so issues-event pickups are no longer cancelled by the repo-wide 'dev-lead' group).

The replacement is a clear inline comment pointing to petry-projects/.github#402 and the reusable workflow.

Linked issue analysis

No issue is auto-closed by this PR. The description references petry-projects/.github#402 (the umbrella concurrency/permission alignment work) and PR #230 (the stuck PR to be re-triggered after merge). The stated motivation — 7/7 issues-event runs cancelled by the repo-wide concurrency group + reusable workflow requiring statuses: read since #435 — is internally consistent with the diff.

Findings

Security

• statuses: read is a minimum read-only scope; no expansion of write permissions. The job-level permissions: block remains tightly scoped (contents: read, pull-requests: write, issues: write, actions: read, checks: read, statuses: read). The top-level permissions: {} default-deny is preserved.
• No new run: blocks, no script-injection-prone ${{ github.event.* }} interpolations introduced. The deleted concurrency expression used github.event.check_run.head_sha, which only flowed into a group: name (not a shell), and the expression is gone entirely.
• No secrets, env, or workflow_call inputs changed.

Correctness

• Centralising concurrency in the reusable workflow is the right fix for the cancellation pattern described (a single 'dev-lead' group across event types will cascade-cancel). Removing the caller-side block prevents the caller from re-introducing the same drift.
• The statuses: read addition matches the stated reusable-workflow requirement and aligns with peer callers per the PR description.

Maintainability

• The replacement comment clearly states why the caller no longer owns concurrency and links to the tracking issue — good for the next person debugging a queued/cancelled run.
• Trailing inline comment on statuses: read documents the cross-repo coupling to #435.

No blocking issues.

CI status

All required checks green: CI / Lint, CI / Format, CI / Secret scan (gitleaks), CodeQL / Analyze (actions), SonarCloud (Quality Gate passed, 0 new issues), AgentShield, dev-lead / dispatch, pr-auto-review / check-and-dispatch, dependency-audit / Detect ecosystems. Skipped checks are language-specific audits not applicable to a YAML-only change. No failing checks. CodeRabbit was rate-limited (not a failure); Gemini doesn't review this file type; Copilot left an informational overview only.

---

Reviewed automatically by the PR-review agent (claude-opus-4-7). Reply if you need a human review.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Config error

SonarCloud failed to complete analysis on this PR, which only modifies .github/workflows/dev-lead.yml. Because SonarCloud is an external quality gate (not a GitHub Actions job), it relies on a prior CI run to upload analysis results; if the workflow restructuring (removing the repo-level concurrency block and adding statuses: read) caused the triggering job to behave differently, SonarCloud may have received no scan data and auto-failed the gate. This is consistent with the PR description noting that the old concurrency group was cancelling 7/7 issues-event runs — a similar cancellation or startup_failure during this scan could leave SonarCloud without results.

Suggested fix: Re-run the SonarCloud analysis job via gh run rerun --failed --repo petry-projects/ContentTwin (or trigger a new push) so that the updated workflow with statuses: read executes cleanly and uploads a fresh analysis result to SonarCloud.

View run logs