feat: implement issue #210 — Compliance: non-stub-dependency-audit.yml by don-petry · Pull Request #298 · combsmith/bmad-bgreat-suite

don-petry · 2026-06-10T14:20:18Z

Closes #210

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

Chores
- Updated workflow configuration reference to use version tag instead of commit-based reference for improved dependency management.

chatgpt-codex-connector · 2026-06-10T14:20:23Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

coderabbitai · 2026-06-10T14:20:28Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a12358a9-b1f8-4735-8fbf-cf6f1c8bdcf2

📥 Commits

Reviewing files that changed from the base of the PR and between 4ae9390 and 1207f29.

📒 Files selected for processing (1)

.github/workflows/dependency-audit.yml

📝 Walkthrough

Walkthrough

The dependency-audit.yml workflow's single job updates its uses: reference from a pinned commit SHA to the @v1 tag when calling the reusable dependency-audit-reusable.yml workflow. No other configuration in the workflow file is changed.

Changes

Dependency Audit Workflow Reference Update

Layer / File(s)	Summary
Switch reusable workflow reference to `@v1` `.github/workflows/dependency-audit.yml`	The `uses:` field in the `dependency-audit` job is changed from a pinned commit SHA to `petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

petry-projects/bmad-bgreat-suite#78: Also modifies .github/workflows/dependency-audit.yml to use the org reusable workflow pinned to @v1.
petry-projects/bmad-bgreat-suite#287: Updates GitHub workflow uses: references to reusable workflows using the @v1 tag in .github/workflows files.

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title references issue `#210` which targets dependency-audit.yml, but the PR actually modifies agent-shield.yml, making the title misleading about what was changed.	Update the title to accurately reflect the actual file modified (agent-shield.yml), or correct the PR to modify the intended file (dependency-audit.yml) as specified in issue `#210`.
Linked Issues check	⚠️ Warning	Issue `#210` requires pinning dependency-audit.yml to `@v1` and adopting the canonical stub pattern, but the PR modifies agent-shield.yml instead and moves it away from `@v1` to a commit SHA, failing to address the linked issue.	Modify the correct file (dependency-audit.yml) to adopt the canonical stub pattern delegating to the reusable workflow at `@v1` as required by issue `#210`.
Out of Scope Changes check	⚠️ Warning	The PR modifies agent-shield.yml which is entirely out of scope for issue `#210` that targets dependency-audit.yml, and the directional change contradicts org standards by moving away from `@v1`.	Remove the agent-shield.yml changes and instead implement the required changes to dependency-audit.yml to make it compliant with the organization's standards.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev-lead/issue-210-20260610-1417

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist · 2026-06-10T14:20:29Z

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Copilot

Pull request overview

Updates the repository’s dependency-audit.yml workflow stub to meet org compliance requirements by pinning the reusable workflow reference to the @v1 tag (per issue #210 and the central standards).

Changes:

Switch the reusable workflow reference from a specific commit SHA to @v1 for the dependency audit workflow stub.

don-petry · 2026-06-10T14:37:06Z

Dev-Lead — review-changes (applied)

Changes committed and pushed.

don-petry · 2026-06-10T15:03:42Z

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

don-petry · 2026-06-10T21:38:38Z

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

donpetry-bot · 2026-06-10T21:53:52Z

CI checks on this PR are still running. Once they complete, re-mention @donpetry-bot to trigger a fresh review.

Posted by the donpetry-bot PR-review cascade.

don-petry · 2026-06-10T21:54:06Z