feat: implement issue #348 — Compliance: non-stub-feature-ideation.yml

[don-petry]

Closes #348

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Updated an automation workflow reference to use the latest tagged version instead of a fixed revision.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d7e6c01b-3417-42f5-9937-548d6eec4f93

📥 Commits

Reviewing files that changed from the base of the PR and between fe5d2ae and 96f7a84.

📒 Files selected for processing (1)

• sonar-project.properties

📝 Walkthrough

Walkthrough

The ideate job in feature-ideation.yml now references the reusable workflow using the @v1 tag instead of a pinned commit SHA. No other workflow configuration changed.

Changes

Workflow Reference Update

Layer / File(s)	Summary
Pin reusable workflow to @v1 .github/workflows/feature-ideation.yml	The uses: reference for the ideate job is updated to petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1, replacing a pinned commit SHA.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• Compliance: non-stub-feature-ideation.yml markets#301: Addresses the compliance finding by pinning feature-ideation.yml to @v1, matching the required remediation.
• Compliance: non-stub-feature-ideation.yml broodly#368: Addresses the same compliance requirement to pin the reusable workflow reference to @v1.
• Compliance: non-stub-feature-ideation.yml TalkTerm#340: Involves the same feature-ideation.yml reusable workflow reference aligned to @v1.
• Compliance: non-stub-feature-ideation.yml .github-private#944: Matches the compliance fix requiring feature-ideation.yml to use @v1.

Possibly related PRs

• petry-projects/bmad-bgreat-suite#78: Updates workflow wiring to delegate jobs to org reusable workflows pinned with the same @v1 reference pattern.
• petry-projects/bmad-bgreat-suite#287: Updates a GitHub Actions job to reference the same reusable workflow at the @v1 tag.
• petry-projects/bmad-bgreat-suite#299: Changes the uses reference for a reusable workflow to the @v1 tag in a similar workflow file.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly references issue #348 and the feature-ideation compliance fix.
Linked Issues check	✅ Passed	The workflow now pins the reusable reference to @v1, matching the issue's compliance requirement.
Out of Scope Changes check	✅ Passed	The PR only changes the workflow reference version and adds no unrelated scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-348-20260703-1422

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

This PR targets Issue #348 (CI workflow compliance for feature-ideation.yml), but the actual change modifies the redispatch job trigger condition for discussion: created events.

Changes:

• Removes the author_association allowlist from the redispatch job’s if: guard, leaving only a non-bot check.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 96f7a844baf97d0ccf6a72b1e58cd1a86c7dcb14
Review mode: triage-approved (single reviewer)

Summary

Two-file compliance fix implementing issue #348: (1) .github/workflows/feature-ideation.yml re-pins the first-party reusable workflow reference from a commit SHA to @v1, exactly as the org standard and the compliance audit finding require; (2) sonar-project.properties adds a scoped S7637 ignore entry (s7637_featureideation) for feature-ideation.yml, mirroring the existing documented pattern for other first-party caller stubs. Triage assessment of low risk is confirmed.

Linked issue analysis

Issue #348 (compliance-audit finding non-stub-feature-ideation.yml) requires the feature-ideation.yml reusable reference to be pinned to @v1 per petry-projects/.github standards/ci-standards.md. The final diff changes the uses: line to petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1, substantively addressing the finding. The companion SonarCloud ignore entry prevents the S7637 SHA-pin rule from re-flagging this intentional, org-mandated first-party @v1 reference; third-party actions retain full SHA-pin enforcement.

Findings

No blocking findings. Notes: (1) An earlier commit (2563392) mistakenly removed the author_association allowlist on the redispatch job — Copilot flagged it, and subsequent commits reverted it; the final cumulative diff does not touch that guard. Both Copilot review threads are resolved and outdated. (2) Moving from SHA-pin to @v1 is acceptable here because the target is a same-org first-party reusable workflow and the org standard explicitly mandates @v1 for these caller stubs. (3) Secret-scanning MCP tool unavailable in this environment; gitleaks CI check passed and the diff contains no secret material.

CI status

All checks green at 96f7a84: CI Validate, gitleaks secret scan, CodeQL (actions), AgentShield, SonarCloud quality gate (0 new issues, 0 hotspots), dependency-audit (ecosystem scans skipped — none detected), PR Review Agent, CodeRabbit status. No failures; skips are expected conditional jobs.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.