chore: cut .github ring0 dogfood callers to local refs (#541) by don-petry · Pull Request #542 · petry-projects/.github

don-petry · 2026-06-26T22:08:58Z

Summary

.github is the ring0 dogfood tier (epic #495) — its own callers should run the latest reusable code so regressions surface at the source. Two were frozen on a stale @v2 cross-repo tag and silently weren't dogfooding. Cut them over to the local-ref form already used by auto-rebase.yml / dependabot-rebase.yml / pr-review-mention.yml:

Caller	Before	After
`agent-shield.yml`	`…/agent-shield-reusable.yml@v2`	`./.github/workflows/agent-shield-reusable.yml`
`dependabot-automerge.yml`	`…/dependabot-automerge-reusable.yml@v2`	`./.github/workflows/dependabot-automerge-reusable.yml`

Compatibility (checked against HEAD reusables)

agent-shield-reusable.yml — all workflow_call inputs optional; stub passes none. ✓
dependabot-automerge-reusable.yml — required secrets APP_ID/APP_PRIVATE_KEY already supplied by the stub's unchanged secrets: inherit. ✓

.github is in SKIP_REPOS and exempt from the centralized-stub audit, so these local refs won't be reverted. Only affects .github's own repo automation — the safest place to dogfood.

Closes #541. Refs #870, #495.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated automation workflows to use repository-local reusable logic instead of an external shared version.
- This keeps the workflow behavior aligned with the current project configuration and simplifies maintenance.

@v2

.github is the ring0 dogfood tier — its own callers should run the latest reusable code via a local ref so regressions surface at the source. Two were frozen on a stale @v2 cross-repo tag and weren't dogfooding; cut them over to the local-ref form already used by auto-rebase/dependabot-rebase/pr-review-mention: agent-shield.yml @v2 -> ./.github/workflows/agent-shield-reusable.yml dependabot-automerge.yml @v2 -> ./.github/workflows/dependabot-automerge-reusable.yml Verified against HEAD reusables: agent-shield inputs are all optional; dependabot-automerge's required secrets (APP_ID/APP_PRIVATE_KEY) are already supplied via the stub's `secrets: inherit` (unchanged). .github is exempt from the centralized-stub audit and the deploy sweep (SKIP_REPOS), so the local refs won't be reverted. Only affects .github's own repo automation. Closes #541. Refs #870, #495.

chatgpt-codex-connector · 2026-06-26T22:09:01Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

gemini-code-assist · 2026-06-26T22:09:05Z

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

coderabbitai · 2026-06-26T22:09:06Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3e9a9935-0f23-4b6c-89ab-68085d45fca7

📥 Commits

Reviewing files that changed from the base of the PR and between c60e75a and ff7255e.

📒 Files selected for processing (2)

.github/workflows/agent-shield.yml
.github/workflows/dependabot-automerge.yml

📝 Walkthrough

Walkthrough

Both workflow stubs now call local reusable workflow files instead of the centrally hosted @v2 versions.

Changes

Local reusable workflow callers

Layer / File(s)	Summary
Reusable workflow targets `./.github/workflows/agent-shield.yml`, `./.github/workflows/dependabot-automerge.yml`	Both jobs switch their `uses:` reference from the remote `petry-projects/.github` reusable workflow to the local repository reusable workflow path.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

petry-projects/.github#87: Introduces the reusable workflow implementations that these callers now point to locally.
petry-projects/.github#88: Changes the same caller stubs to delegate to reusable workflows, matching the same delegation pattern.
petry-projects/.github#491: Also adjusts agent-shield and dependabot-automerge workflow stubs by changing their reusable-workflow references.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and accurately summarizes the workflow callers being switched to local refs.
Linked Issues check	✅ Passed	The PR updates both requested workflow callers to local reusable refs, matching issue `#541`.
Out of Scope Changes check	✅ Passed	The only changes are the two requested workflow ref updates, with no unrelated edits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/ring0-dogfood-local-refs-541

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

don-petry · 2026-06-26T22:09:07Z

@donpetry-bot please review

donpetry-bot · 2026-06-26T22:09:19Z

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

don-petry · 2026-06-26T22:09:54Z

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

donpetry-bot

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 79f46fdba2614095090d90fd119f255136f8a02d
Review mode: triage-approved (single reviewer)

Summary

Cuts two ring0 dogfood callers (agent-shield.yml, dependabot-automerge.yml) from a stale cross-repo @v2 tag to the local-ref form (./.github/workflows/...-reusable.yml), so .github's own automation exercises the latest reusable code. Net 2 additions / 2 deletions across 2 stub files.

Linked issue analysis

Closes #541, which asks for exactly this change: both callers were frozen on @v2 while the reusables advanced on main, so the ring0 dogfood tier silently ran old code. The diff matches the issue's prescribed fix table line-for-line and aligns these stubs with the local-ref form already used by auto-rebase.yml / dependabot-rebase.yml / pr-review-mention.yml.

Findings

No issues. Compatibility verified against the reusables at HEAD: agent-shield-reusable.yml exposes only optional workflow_call inputs (all with defaults), and the stub passes none — safe. dependabot-automerge-reusable.yml requires secrets APP_ID/APP_PRIVATE_KEY, which the stub's unchanged 'secrets: inherit' continues to supply. The @v2 -> local-ref switch is not a supply-chain regression: a './' ref resolves within the same repo/commit as the caller (the safest reference form), and is the intended ring0 dogfood design per epic #495. .github is in SKIP_REPOS and exempt from the centralized-stub audit, so these local refs won't be reverted.

CI status

All required checks green: ShellCheck, Lint, CodeQL, SonarCloud, Secret scan (gitleaks), Agent Security Scan, AgentShield, npm audit, CodeRabbit all SUCCESS. Remaining entries (cargo audit, govulncheck, pip-audit, pnpm audit, dependabot-automerge, pr-review-mention) are SKIPPED by design. No failures. mergeStateStatus is BEHIND (branch behind base) but mergeable=MERGEABLE.

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

sonarqubecloud · 2026-06-26T22:13:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

don-petry · 2026-06-26T22:14:54Z

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
No actionable findings — Quality Gate passed with 0 new issues, 0 security hotspots
No Tier 1 blockers present
Files changed: .github/workflows/agent-shield.yml, .github/workflows/dependabot-automerge.yml
```
The PR is ready. One check ("Analyze (actions)") is still in progress and may be monitored separately by the CI workflow.

don-petry requested a review from a team as a code owner June 26, 2026 22:08

don-petry enabled auto-merge (squash) June 26, 2026 22:09

donpetry-bot approved these changes Jun 26, 2026

View reviewed changes

Merge branch 'main' into chore/ring0-dogfood-local-refs-541

ff7255e

don-petry disabled auto-merge June 26, 2026 22:14

don-petry enabled auto-merge (squash) June 26, 2026 22:14

don-petry merged commit 78ede00 into main Jun 26, 2026
20 of 21 checks passed

don-petry deleted the chore/ring0-dogfood-local-refs-541 branch June 26, 2026 22:15

coderabbitai Bot approved these changes Jun 26, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore: cut .github ring0 dogfood callers to local refs (#541) - #542

chore: cut .github ring0 dogfood callers to local refs (#541)#542
don-petry merged 2 commits into
mainfrom
chore/ring0-dogfood-local-refs-541

don-petry commented Jun 26, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

chatgpt-codex-connector Bot commented Jun 26, 2026

Uh oh!

gemini-code-assist Bot commented Jun 26, 2026

Uh oh!

coderabbitai Bot commented Jun 26, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

don-petry commented Jun 26, 2026

Uh oh!

donpetry-bot commented Jun 26, 2026

Uh oh!

don-petry commented Jun 26, 2026

Uh oh!

donpetry-bot left a comment

Uh oh!

sonarqubecloud Bot commented Jun 26, 2026

Uh oh!

don-petry commented Jun 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

don-petry commented Jun 26, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Compatibility (checked against HEAD reusables)

Summary by CodeRabbit

Uh oh!

chatgpt-codex-connector Bot commented Jun 26, 2026

Uh oh!

gemini-code-assist Bot commented Jun 26, 2026

Uh oh!

coderabbitai Bot commented Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

don-petry commented Jun 26, 2026

Uh oh!

donpetry-bot commented Jun 26, 2026

Uh oh!

don-petry commented Jun 26, 2026

Dev-Lead — review-changes (no-changes)

Uh oh!

donpetry-bot left a comment

Choose a reason for hiding this comment

Automated review — APPROVED ✓

Summary

Linked issue analysis

Findings

CI status

Uh oh!

sonarqubecloud Bot commented Jun 26, 2026

Quality Gate passed

Uh oh!

don-petry commented Jun 26, 2026

Dev-Lead — fix-bot-comment (no-changes)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

don-petry commented Jun 26, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 26, 2026 •

edited

Loading