chore: major-scope repin self-consumer stubs [#657 F5]

[don-petry]

Re-pins meta-repo caller stubs bare @/ -> @/v- (deploy tool exempts meta-repos; needed so the inner-ring canary flow doesn't freeze once the engine promotes v-lines, and to unblock the guarded bare-tag retirement). Completes the #657 F5 live migration. NOSONAR markers preserved.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0bd04c3c-e4fd-406c-b898-921f74df6b13

📥 Commits

Reviewing files that changed from the base of the PR and between 4f2ae06 and da5ff0d.

📒 Files selected for processing (7)

• .github/workflows/add-to-project.yml
• .github/workflows/ci-failure-analyst.yml
• .github/workflows/feature-ideation.yml
• .github/workflows/idea-triage.yml
• .github/workflows/initiative-planner.yml
• .github/workflows/pr-auto-review.yml
• sonar-project.properties

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/major-scope-repin-20260713

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-14T02:02:45Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

**Bot:** SonarCloud  
**Status:** Quality Gate ✅ Passed  
**Issues to fix:** 0 (no actionable issues raised)
The PR changes (workflow channel ref updates and Sonar exemptions for re-pinned stubs) have passed all code analysis checks:
- ✅ SonarCloud: 0 new issues
- ✅ CodeQL: success  
- ✅ AgentShield: success
- ✅ Validate: success
- ⓪ dev-lead dispatch jobs: cancelled (expected for this dispatch type)
**No code changes are needed.** The SonarCloud analysis is clean, and the workflow re-pinning to versioned channel tags (`v1-stable`, `v1-ring1`) with proper NOSONAR exemptions is working as intended.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: da5ff0d47ad15c32621ec180823c662c2a13c92c
Review mode: triage-approved (single reviewer)

Summary

Re-pins 6 self-consumer caller stubs from bare channel tags (@/) to major-scoped channel tags (@/v1-), completing the #657 F5 live migration (option 1: major-scoped channels). Also adds two SonarCloud S7637 exemptions (ci-failure-analyst.yml, idea-triage.yml) for the re-pinned refs. Only the ref suffix on each uses: line changes; permissions, secrets wiring, and NOSONAR markers are preserved verbatim. Triage assessment confirmed.

Linked issue analysis

No closing issue reference, but the PR body cites combsmith/.github#657 (Story F: major-version boundary in the channel/ring model). That issue's option 1 calls for major-scoped channel tags so breaking releases require a deliberate consumer re-pin; this PR performs exactly that re-pin for this repo's stubs. Substantively consistent with the referenced work.

Findings

No blocking findings.

• Refs remain mutable first-party channel tags rather than SHA pins — pre-existing, documented policy for first-party channel refs (inline NOSONAR markers + sonar-project.properties exemptions; PR body notes the deploy tool exempts meta-repos). The change is strictly tighter (tier -> v1-tier).
• Secret wiring (explicit secrets and secrets: inherit lines) is byte-identical apart from trailing-newline removal.
• Minor (non-blocking): all 7 files lost their trailing newline (\ No newline at end of file).
• Minor (non-blocking): the two new Sonar resourceKeys use broader globs (**/ci-failure-analyst.yml, **/idea-triage.yml) than the **/.github/workflows/... pattern used by existing entries.
• Secret scan: run_secret_scanning MCP tool unavailable in this run; gitleaks CI check passed and no credential material appears in the diff.

CI status

All substantive checks green: Validate, Secret scan (gitleaks), CodeQL, SonarCloud (quality gate passed, 0 new issues), AgentShield, dependency-audit (detect + skipped ecosystems), pr-auto-review, review/review, CodeRabbit status SUCCESS. Two dev-lead agent dispatch jobs (dispatch, ci-relay) show CANCELLED — these are advisory agent-orchestration jobs; the dev-lead agent reported no-changes via comment. mergeable=MERGEABLE; merge state BLOCKED only on required review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.