feat: implement issue #425 — SonarCloud: miscellaneous findings

[don-petry]

User description

Closes #425

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Clarify which CI workflow triggers automatic pull request reviews

What Changed

• The workflow documentation now identifies the repository’s CI workflow as the source for completed CI events
• No review or CI behavior was changed

Impact

✅ Clearer automatic review workflow configuration

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	285ebec	Aug 18, 2026 · 20:42	20:42

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 38 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: adb59ca7-76ee-4477-ad57-d71b41563f5d

📥 Commits

Reviewing files that changed from the base of the PR and between 0848426 and 285ebec.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-18T21:43:42Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 285ebecb970f8f395aee97d21ab2e741ef2ed217
Review mode: triage-approved (single reviewer)

Summary

One-line comment-only change in .github/workflows/pr-auto-review.yml: replaces a TODO comment with accurate documentation stating the workflow_run trigger matches this repository's CI workflow (.github/workflows/ci.yml, name: CI). Verified against the repo at the head SHA — ci.yml exists and is named CI, so the existing trigger config was already correct and no behavioral change occurs. This confirms the triage tier's low-risk assessment.

Linked issue analysis

Closes #425 (SonarCloud: miscellaneous findings). The issue's single finding was githubactions:S1135 — 'Complete the task associated to this TODO comment' in pr-auto-review.yml. This PR resolves it with a real fix (accurate replacement comment, no NOSONAR suppression), meeting the issue's acceptance criteria: SonarCloud quality gate passed with 0 new/open issues on this PR and no behavior change.

Findings

No findings. Comment-only diff; no logic, trigger, permission, or secret changes. The new comment's factual claim was independently verified (ci.yml declares name: CI). Secret scan: the run_secret_scanning MCP tool was unavailable in this run; noting per protocol — the gitleaks CI secret scan passed, and the diff contains no secret-like content. Advisory bots: CodeAnt reviewed (no issues raised), SonarCloud quality gate passed; Codex/Qodo/CodeRabbit were rate- or billing-limited but are advisory only and non-blocking for a comment-only change.

CI status

All checks green: CI (Detect ecosystems, Secret scan/gitleaks) SUCCESS; CodeQL SUCCESS; SonarCloud + quality gate SUCCESS; AgentShield SUCCESS; dependency-audit SUCCESS (per-ecosystem jobs skipped as expected); remaining skips are conditional jobs (Backend/Frontend CI, dependabot). No failures.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.