chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

User description

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• dev-lead.yml
• pr-auto-review.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

---

CodeAnt-AI Description

Sync org workflow stubs to the latest standard release

What Changed

• Updated the PR auto-review workflow to use the new stable reusable channel and a fallback secret name, so it can keep running in repos that have either secret set
• Removed the old fork/dependabot skip check from the caller stub and aligned the workflow notes with the new adoption path
• Updated the dev lead workflow to the new stable channel and matching agent reference so it follows the current org standard

Impact

✅ Fewer PR review setup failures
✅ Smoother workflow adoption across repos
✅ Consistent org-standard automation behavior

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	94bdc80	Jul 22, 2026 · 11:45	11:46

_{Updated in place by CodeAnt AI · last 5 reviews}

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 86a8013c-5391-4337-98ed-212457c5a36a

📥 Commits

Reviewing files that changed from the base of the PR and between 65594d5 and 5cde59f.

📒 Files selected for processing (2)

• .github/workflows/dev-lead.yml
• .github/workflows/pr-auto-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260722

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[qodo-code-review]

PR Summary by Qodo

Sync org-standard workflow stubs to v1-stable channels

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Re-pin dev-lead workflow stub to the org-managed dev-lead/v1-stable channel.
• Re-pin PR Auto-Review stub to pr-auto-review/v1-stable and refresh caller guidance.
• Add canonical-first secret fallback for PR Auto-Review reusable authentication.

Diagram

graph TD
  A["Repo: Workflows"] --> B["dev-lead.yml"] --> C["Reusable: dev-lead @v1-stable"]
  A --> D["pr-auto-review.yml"] --> E["Reusable: pr-auto-review @v1-stable"] --> F[("Org secret: GH_PAT_*")]
  C --> G{{"GitHub API"}}
  E --> G
  subgraph Legend
    direction LR
    _repo["Workflow stub"] ~~~ _reusable["Reusable workflow"] ~~~ _secret[("Secret")] ~~~ _ext{{"External"}}
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin reusables to a fixed release tag (e.g., @v1, @v2)

• ➕ Deterministic behavior per repo until explicitly upgraded
• ➕ Easier to correlate behavior to a known version
• ➖ Conflicts with the stated org moving-channel/compliance model
• ➖ Slower emergency rollback/roll-forward across the fleet

2. Pin reusables to an immutable commit SHA

• ➕ Maximum supply-chain determinism
• ➕ Avoids accidental behavior drift from tag moves
• ➖ Operationally heavy for fleet-wide upgrades/rollbacks
• ➖ Explicitly called out as rejected by compliance audit in the stub guidance

3. Keep prior stable channel names (*/stable) instead of v1-stable

• ➕ Avoids churn across repos and reduces template diffs
• ➖ Does not align with the new channel naming/versioning scheme
• ➖ Makes it harder to run parallel major versions during migrations

Recommendation: Keep the PR’s approach: moving-channel pins to v1-stable provide centralized rollout/rollback and match the documented org standard. The only thing to double-check in review is that removing the prior fork/dependabot gating is safe given the new secret fallback and the reusable’s own handling of event contexts.

Files changed (2) +23 / -24

Other (2) +23 / -24

dev-lead.ymlRe-pin dev-lead stub to dev-lead/v1-stable channel +5/-5

Re-pin dev-lead stub to dev-lead/v1-stable channel

• Updates the reusable workflow reference from dev-lead/stable to dev-lead/v1-stable and threads the same channel through agent_ref. Keeps the job permissions and thin-caller model intact.

.github/workflows/dev-lead.yml

pr-auto-review.ymlRe-pin PR Auto-Review stub to v1-stable and add PAT fallback +18/-19

Re-pin PR Auto-Review stub to v1-stable and add PAT fallback

• Updates guidance comments to enforce the moving-channel pin, adds adoption notes and a TODO for CI workflow naming, and repoints the reusable to pr-auto-review/v1-stable. Removes the previous fork/Dependabot gating condition and adds a canonical-first PAT secret fallback while keeping the passed secret name GH_PAT_WORKFLOWS.

.github/workflows/pr-auto-review.yml

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate / static analysis scan
Root cause: Lint/style

The diff for .github/workflows/dev-lead.yml drops the # NOSONAR(githubactions:S7635) first-party trusted reusable suppression comment from the secrets: inherit line while leaving the underlying secrets: inherit pattern in place. SonarCloud re-flags that line as rule S7635 (unrestricted secrets propagation) since the inline suppression it relies on no longer exists, which trips the quality gate on new code smells.

Suggested fix: Re-add the # NOSONAR(githubactions:S7635) first-party trusted reusable comment to the secrets: inherit line in .github/workflows/dev-lead.yml (matching the still-present suppression on the pr-auto-review.yml uses: line).

View run logs

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 138 rules

✅ Skills: 6 invoked

  bmad-testarch-ci

  bmad-testarch-trace

  bmad-testarch-atdd

  bmad-testarch-framework

  bmad-testarch-automate

  bmad-testarch-test-review

1. Fork PR secret regression ✓ Resolved 🐞 Bug ☼ Reliability

Description

pr-auto-review removed the job-level if: that prevented invoking the reusable on fork/Dependabot
PR events where repository secrets aren’t available. As a result, runs triggered by pull_request /
pull_request_review can call the reusable without a usable GH_PAT_WORKFLOWS, breaking the
ready-check for those PRs.

Code

.github/workflows/pr-auto-review.yml[L46-52]

-    # Skip pull_request / pull_request_review events from forks and Dependabot:
-    # secrets are unavailable in those contexts, so the reusable's GH_PAT_WORKFLOWS
-    # call would fail. The later workflow_run path runs with secrets after CI finishes.
-    if: >
-      github.event_name != 'pull_request' && github.event_name != 'pull_request_review' ||
-      (github.event.pull_request.head.repo.full_name == github.repository &&
-       github.event.pull_request.user.login != 'dependabot[bot]')

Relevance

⭐⭐⭐ High

Team previously accepted a fork/Dependabot guard to avoid missing secrets for PR events (PR #245).

PR-#245

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow triggers on pull_request/pull_request_review and always invokes the reusable while
passing a PAT secret; the PR removed the previously accepted guard that prevented running in
contexts where secrets are unavailable.

.github/workflows/pr-auto-review.yml[27-58]
PR-#245

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`pr-auto-review` used to skip secret-dependent runs for fork/Dependabot PR events via a job-level `if:`; that guard was removed. This can cause the reusable invocation to run without secrets and fail.

### Issue Context
The workflow is triggered by `pull_request` and `pull_request_review` and passes `GH_PAT_WORKFLOWS` into the reusable.

### Fix Focus Areas
- .github/workflows/pr-auto-review.yml[46-52]

### Suggested change
Re-introduce a job-level condition equivalent to the removed guard, e.g. skip `pull_request`/`pull_request_review` when the PR head repo is not `github.repository` and/or when actor is Dependabot, relying on `workflow_run`/other secret-available paths instead.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Missing inherit NOSONAR ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

dev-lead.yml now uses secrets: inherit without the repo’s standard
NOSONAR(githubactions:S7635) suppression, unlike other first-party reusable callers. If SonarCloud
enforces S7635 here (as implied by other stubs), this change can introduce a new Quality Gate
failure.

Code

.github/workflows/dev-lead.yml[67]

+    secrets: inherit

Relevance

⭐⭐⭐ High

Repo previously accepted adding # NOSONAR(githubactions:S7635) on secrets: inherit (PR #356).

PR-#356
PR-#321

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

dev-lead.yml is now the odd-one-out: it uses secrets: inherit without the suppression used
across the repo’s other first-party reusable callers.

.github/workflows/dev-lead.yml[57-74]
.github/workflows/pr-review.yml[63-76]
.github/workflows/auto-rebase.yml[48-54]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`dev-lead.yml` removed the inline `# NOSONAR(githubactions:S7635)` suppression on `secrets: inherit`, which is consistently used elsewhere in this repo for trusted first-party reusables.

### Issue Context
Other workflow stubs (auto-rebase, pr-review, etc.) keep the S7635 suppression on `secrets: inherit`, suggesting SonarCloud flags it and the repo expects the suppression to avoid drift/Quality Gate noise.

### Fix Focus Areas
- .github/workflows/dev-lead.yml[67-67]

### Suggested change
Restore the inline marker, e.g.:
`secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable`

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. workflow_run too narrow 🐞 Bug ≡ Correctness

Description

pr-auto-review only reruns on workflow_run completion of CI, but this repo’s required checks
include other GitHub Actions workflows (SonarCloud, AgentShield, Dependency audit). Readiness can be
evaluated before those checks finish and not re-evaluated when they complete.

Code

.github/workflows/pr-auto-review.yml[R32-34]

  workflow_run:
    workflows: ["CI"]
    types: [completed]

Relevance

⭐ Low

Team recently narrowed workflow_run.workflows back to only CI to avoid drift/redundant runs (PR
#358).

PR-#358
PR-#245

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The pr-auto-review stub watches only CI, while repo-required checks are produced by other GitHub
Actions workflows with different workflow names; therefore their completion won’t trigger the
workflow_run pathway.

.github/workflows/pr-auto-review.yml[27-34]
.github/scripts/apply-code-quality-ruleset.sh[7-13]
.github/scripts/apply-code-quality-ruleset.sh[55-60]
.github/workflows/sonarcloud.yml[1-13]
.github/workflows/agent-shield.yml[18-33]
.github/workflows/dependency-audit.yml[16-33]
PR-#245

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`on.workflow_run.workflows` is currently limited to `["CI"]`, so the ready-check won’t be retriggered by completion of other Actions-based required checks.

### Issue Context
This repo’s ruleset requires checks emitted by workflows named `SonarCloud Analysis`, `AgentShield`, and `Dependency audit` (and possibly CodeQL). Those are separate workflows from `CI`.

### Fix Focus Areas
- .github/workflows/pr-auto-review.yml[32-34]

### Suggested change
Expand `workflow_run.workflows` to include all relevant workflow **name:** values used in this repo, e.g.:
`workflows: ["CI", "SonarCloud Analysis", "AgentShield", "Dependency audit"]`
(Ensure names exactly match the workflows’ `name:` fields.)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-22T12:51:24Z.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Superseding: this PR was generated from the pre-#876 dev-lead template that lacked the # NOSONAR(githubactions:S7635) marker on secrets: inherit. #876 restored the marker in the template; after the driver is made marker-aware (tracked in the new follow-up), a re-sweep will re-open this with correct pins AND the S7635 marker (maximum quality). Closing to avoid deploying a marker-less stub.