chore: sync 1 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• pr-auto-review.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 57 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e26953b0-e8de-48ff-94d3-f17003bf5de0

📥 Commits

Reviewing files that changed from the base of the PR and between 3417f5d and 7297212.

📒 Files selected for processing (2)

• .github/workflows/pr-auto-review.yml
• sonar-project.properties

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260721

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[Copilot]

Pull request overview

This PR adds the org-standard PR Auto-Review thin caller stub to this repository, wiring repo events (PR activity + CI completion) to the centralized petry-projects/.github reusable workflow that performs the readiness evaluation.

Changes:

• Introduces .github/workflows/pr-auto-review.yml workflow stub to invoke the org reusable.
• Configures triggers for readiness re-evaluation on CI completion, PR review events, and PR lifecycle events.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
```
The SonarCloud Quality Gate has passed with zero issues. No actionable bot findings require fixing. The PR is clean and ready.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 7297212866b43188e231f4c4c006b693856bfb1e
Review mode: triage-approved (single reviewer)

Summary

Standards-sync PR adding the org-standard pr-auto-review.yml thin caller stub (58 lines) plus a narrowly-scoped Sonar S7637 exemption for it. Verified against the source of truth (petry-projects/.github/standards/workflows/pr-auto-review.yml): the stub is identical except the uses: channel tier — @pr-auto-review/v1-next instead of the template's @pr-auto-review/stable. That deviation is sanctioned: central issue petry-projects/.github#847 documents .github-private as a canary ring0 repo whose stubs pin to non-stable tiers (matching the existing feature-ideation/v1-next pin), with the deploy script computing the tier; #848 implemented the SKIP_OVERRIDES opt-in. Workflow permissions are minimal (top-level permissions: {}, job-level read-only). The GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS secret fallback matches the template exactly and is the established canonical-first pattern (.github-private#1326). The Sonar exemption is per-file (ruleKey S7637 + **/pr-auto-review.yml resourceKey), consistent with the file's own rule against blanket exemptions.

Linked issue analysis

No linked issues in this repo (standards-sync PRs are opened by scripts/deploy-standard-workflows.sh without one). The PR substantively resolves central compliance issue petry-projects/.github#847 (.github-private flagged non-compliant for missing pr-auto-review), via the mechanism chosen in petry-projects/.github#848.

Findings

Non-blocking observations:

1. Header/ref mismatch (cosmetic, upstream) — the stub's header comment says the channel MUST be @pr-auto-review/stable, but this canary repo correctly pins @pr-auto-review/v1-next. The deploy script rewrites the tier but not the header text. Consider a follow-up in the central repo so the deploy also adjusts the header note for canary repos.
2. PR body says "deployed verbatim" — slightly imprecise; the tier is computed per-repo. Cosmetic.
3. Secret scanning MCP — run_secret_scanning tool not available in this run; noted and skipped. The gitleaks CI check passed, and the diff introduces no secret material (only a secret reference identical to the org template).

No security, correctness, or maintainability issues found. Moving-channel (unpinned tag) usage is the org's explicit first-party model — frozen pins are rejected by the compliance audit — and the S7637 exemption codifies that per policy.

CI status

All checks green at 7297212866b43188e231f4c4c006b693856bfb1e: CI (Lint, ShellCheck, Agent Security Scan, gitleaks, Compile agentic workflows), Lint suite (shellcheck, actionlint, bats, caller-stub-freeze, template-drift, validate-caller-inputs, gh-aw-compile, persona checks), CodeQL (actions + python), Tests (unit-tests), AgentShield, SonarCloud (Quality Gate passed, 0 new issues, 0 hotspots), Holdout Guard, Test-Deletion Guard, CodeRabbit. Remaining checks skipped by design (dependency-audit ecosystems, dependabot, ci-relay, spec-drift).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.