chore: sync 5 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

User description

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• dev-lead.yml
• auto-rebase.yml
• dependabot-automerge.yml
• pr-auto-review.yml
• feature-ideation.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

---

CodeAnt-AI Description

Sync workflow stubs to the latest org-standard channels and secret handling

What Changed

• Updated the shared workflow callers to use the current stable release channels for auto-rebase, dev lead, PR auto-review, dependabot auto-merge, and feature ideation
• PR auto-review now accepts the canonical org PAT as a fallback, so it can keep running when the preferred secret name is not present
• Kept the existing permissions and workflow behavior otherwise unchanged

Impact

✅ Fewer workflow failures after org updates
✅ More reliable PR auto-review runs
✅ Safer centralized workflow rollouts

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	a1de846	Jul 22, 2026 · 17:33	17:34

_{Updated in place by CodeAnt AI · last 5 reviews}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 654df50b-2349-4d89-8867-02b47c839a24

📥 Commits

Reviewing files that changed from the base of the PR and between 259c744 and a1de846.

📒 Files selected for processing (5)

• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dev-lead.yml
• .github/workflows/feature-ideation.yml
• .github/workflows/pr-auto-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260722

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[qodo-code-review]

PR Summary by Qodo

Sync org-standard GitHub Actions workflow stubs to latest moving-channel tags

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Re-pin org-standard workflow stubs to the current moving-channel refs (v1/v2-stable).
• Add inline NOSONAR justifications for trusted secrets: inherit usage.
• Update PR auto-review to use canonical-first PAT secret fallback while keeping key name stable.

Diagram

graph TD
  A["Repo workflow stubs (.github/workflows)"] --> B["Reusable workflows (petry-projects/.github)"] --> C["Moving-channel tags (v1/v2-stable)"]
  A --> D["Reusable workflows (petry-projects/.github-private)"] --> C
  A --> E["Repo secrets"]
  B --> F["Repo checks / PR gates"]
  D --> F

Loading

High-Level Assessment

This is the expected org-standard approach: keep repository workflows as thin stubs and pin to centrally managed moving-channel tags (v1/v2-stable) to enable rapid org-wide rollout/rollback. Alternatives like pinning to SHA/@main or in-repo duplication would reduce central control and conflict with the stated compliance/standards model.

Files changed (5) +24 / -21

Other (5) +24 / -21

auto-rebase.ymlRe-pin auto-rebase stub to v2-stable and annotate secrets inheritance +2/-2

Re-pin auto-rebase stub to v2-stable and annotate secrets inheritance

• Updates the documented/pinned moving-channel ref from 'auto-rebase/stable' to 'auto-rebase/v2-stable'. Adds a NOSONAR justification comment to the trusted 'secrets: inherit' usage.

.github/workflows/auto-rebase.yml

dependabot-automerge.ymlAnnotate dependabot-automerge secrets inheritance as trusted reusable usage +1/-1

Annotate dependabot-automerge secrets inheritance as trusted reusable usage

• Keeps the reusable pinned to 'dependabot-automerge/v2-stable' and adds a NOSONAR comment clarifying that 'secrets: inherit' is used with a first-party trusted reusable.

.github/workflows/dependabot-automerge.yml

dev-lead.ymlMove dev-lead stub to v1-stable channel and align agent_ref +5/-5

Move dev-lead stub to v1-stable channel and align agent_ref

• Switches the reusable ref from 'dev-lead/stable' to 'dev-lead/v1-stable' and updates 'agent_ref' to match. Adds a NOSONAR justification comment to the trusted 'secrets: inherit' usage.

.github/workflows/dev-lead.yml

feature-ideation.ymlRe-pin feature-ideation stub to v1-stable channel +1/-1

Re-pin feature-ideation stub to v1-stable channel

• Updates the reusable workflow reference from 'feature-ideation/stable' to 'feature-ideation/v1-stable', keeping the rest of the stub intact.

.github/workflows/feature-ideation.yml

pr-auto-review.ymlRe-pin pr-auto-review to v1-stable and add canonical-first PAT secret fallback +15/-12

Re-pin pr-auto-review to v1-stable and add canonical-first PAT secret fallback

• Updates header guidance to enforce the moving-channel model and changes the reusable ref from 'pr-auto-review/stable' to 'pr-auto-review/v1-stable'. Updates the 'GH_PAT_WORKFLOWS' secret value to prefer 'GH_PAT_DON_PETRY' with fallback to the existing secret, preserving the passed key name for reusable compatibility.

.github/workflows/pr-auto-review.yml

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 124 rules

✅ Skills: 5 invoked

  bmad-testarch-ci

  bmad-testarch-test-review

  bmad-testarch-atdd

  bmad-testarch-framework

  bmad-testarch-automate

1. PAT secret docs mismatch 🐞 Bug ⚙ Maintainability

Description

.github/workflows/pr-auto-review.yml now prefers secrets.GH_PAT_DON_PETRY (falling back to
secrets.GH_PAT_WORKFLOWS), but the header still states that GH_PAT_WORKFLOWS is the required org
secret, which can mislead adopters configuring secrets.

Code

.github/workflows/pr-auto-review.yml[R55-58]

+      # Canonical-first fallback (.github-private#1326). The reusable resolves this
+      # secret BY NAME, so only the VALUE changes — the passed key stays named
+      # GH_PAT_WORKFLOWS.
+      GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}

Relevance

⭐⭐⭐ High

Team previously accepted updating workflow headers to match actual uses:/config (doc-reality
mismatch) in PR #170.

PR-#170

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow header documents only GH_PAT_WORKFLOWS as required, while the job now explicitly
prefers GH_PAT_DON_PETRY via an expression fallback, making the header incomplete/out-of-date.

.github/workflows/pr-auto-review.yml[24-24]
.github/workflows/pr-auto-review.yml[53-58]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`pr-auto-review.yml` now supports two secret sources (preferred `GH_PAT_DON_PETRY`, fallback `GH_PAT_WORKFLOWS`), but the file header still documents only `GH_PAT_WORKFLOWS` as required.

### Issue Context
This is a thin workflow stub intended to be copied verbatim into other repos; stale “required secret” guidance can cause incorrect setup assumptions.

### Fix Focus Areas
- .github/workflows/pr-auto-review.yml[24-24]
- .github/workflows/pr-auto-review.yml[55-58]

### Suggested change
Update the header line to something like:
- `Requires: GH_PAT_DON_PETRY (preferred) or GH_PAT_WORKFLOWS (fallback) org secret.`

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: a1de84668a032443ec39c80e88ba556d491f9db6
Cascade: triage → audit (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)

Summary

Standards-sync fanout of 5 thin caller stubs; I independently verified that 4/5 files (including pr-auto-review.yml, the only substantive change) are byte-identical to the org templates in petry-projects/.github at PR head. The secret change (GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS) is a documented, org-owner-authored migration (.github-private#1326) using a safe secrets-context-only fallback expression: value-only change, secret name and job permissions unchanged, first-party reusable refs, and all security scanners (CodeQL incl. actions, gitleaks, AgentShield, SonarCloud) green. The personal-PAT-as-canonical-credential concern is a real governance tradeoff, but the decision point is the upstream template and issue #1326, not this verbatim fanout, and it is explicitly tracked with gated cleanup criteria.

Findings

• minor: Confirmed (accepted documented risk): GH_PAT_DON_PETRY, a personal-account PAT, becomes the preferred credential for org PR-review automation. Ties automation to an individual account (rotation/offboarding/scope breadth vs. a GitHub App or dedicated machine credential). Documented and gated in .github-private#1326; recommend eventually migrating to a GitHub App installation token. Non-blocking here because this PR is a verbatim fanout of the already-adopted org template.
• minor: Stub header still documents GH_PAT_WORKFLOWS as the required org secret while the job now prefers GH_PAT_DON_PETRY. Fix belongs upstream in the template (standards/workflows/pr-auto-review.yml) since stubs are deployed verbatim; adopting repos could otherwise provision only the fallback secret.
• info: Sync-completeness gap: feature-ideation.yml at PR head lags the org template — template lines 110/118 already use the GH_PAT_DON_PETRY-first fallback for the prep job's GH_TOKEN, but this PR only updated the uses: channel tag. Not a security regression (head retains the older GH_PAT_WORKFLOWS-only behavior, valid during the migration window), but the next sync should reconcile it.
• info: Moving-channel tags (v1/v2-stable) on reusable workflow refs are contrary to generic SHA-pinning guidance but are the org's mandated versioning model per ci-standards.md, and all refs target first-party petry-projects repos. Tag renames in this PR are cosmetic channel-name changes with no permission or trigger changes.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.