chore: sync 6 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• pr-review-mention.yml
• agent-shield.yml
• auto-rebase.yml
• dependabot-automerge.yml
• dependabot-rebase.yml
• dependency-audit.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

Summary by CodeRabbit

• Chores
  • Updated internal CI/CD infrastructure workflows for enhanced stability and maintainability across deployment pipelines.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 53 minutes and 6 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 71c39cbb-852d-4e7b-91b3-e246c29fb157

📥 Commits

Reviewing files that changed from the base of the PR and between c1e9a19 and b8db296.

📒 Files selected for processing (1)

• .github/workflows/auto-rebase.yml

📝 Walkthrough

Walkthrough

Five GitHub Actions caller workflows are updated to replace version tag references (@v1, @v2) with pinned commit SHAs on their uses: lines. Several workflows also receive revised header comment blocks that tighten agent guidance around the uses: ref, document inherited secrets, and describe default PR eligibility behavior.

Changes

Reusable Workflow SHA Pins and Caller Documentation

Layer / File(s)	Summary
Caller header documentation updates .github/workflows/auto-rebase.yml, .github/workflows/dependabot-automerge.yml, .github/workflows/dependabot-rebase.yml, .github/workflows/pr-review-mention.yml	Header comment blocks revised to prohibit changing the uses: ref, document inherited secrets, and describe default PR eligibility inputs (eligibility, ready_label) for the auto-rebase caller.
Reusable workflow SHA pin updates .github/workflows/agent-shield.yml, .github/workflows/auto-rebase.yml, .github/workflows/dependabot-automerge.yml, .github/workflows/dependabot-rebase.yml, .github/workflows/dependency-audit.yml, .github/workflows/pr-review-mention.yml	uses: references changed from generic version tags (@v1, @v2) to pinned commit SHAs across all five caller workflows.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• petry-projects/ContentTwin#52: Touches the same three caller workflows (dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml) by standardizing their reusable workflow uses: references.
• petry-projects/ContentTwin#115: Modifies jobs.<job>.uses reusable-workflow references in the same GitHub Actions caller workflow files.
• petry-projects/ContentTwin#127: Updates the dependabot-rebase.yml job's reusable workflow pinned commit SHA directly, the same field changed here.

Suggested reviewers

• donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title accurately describes the primary change: syncing organization-standard workflow stubs from an upstream source into the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260620

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

@don-petry assigned me as reviewer — starting a fresh review now. Results will appear in a few minutes.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (quality gate)
Root cause: Lint/style

SonarCloud flagged 4 high-severity security alerts — one in each of the changed workflow files (auto-rebase.yml, dependabot-automerge.yml, dependabot-rebase.yml, pr-review-mention.yml). All 4 share the same finding: "External GitHub Actions and workflows should be pinned to a commit hash". The PR replaced SHA-pinned uses: refs (e.g. @73231f6f9c38330157ba15a0c05157c505cab00d) with mutable moving tags (e.g. @auto-rebase/stable), which SonarCloud treats as a supply-chain risk because a compromised tag could silently swap in malicious workflow code.

Suggested fix: If the */stable moving-tag pattern is an intentional org-level design, add a SonarCloud issue suppression for rule S6659 on the four affected uses: lines (via the SonarCloud UI → Mark as Won't Fix) to make the quality gate pass without reverting the tag strategy.

View run logs

[don-petry]

Dev-Lead Fix CI — applied

PR: #293 | SHA: 3481d9f906500b13849f0ebfb347a1188af05e95
Fix committed and pushed. Waiting for CI.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 2422453f6d67144d4ab12c8d8ae68a00725113b2
Review mode: triage-approved (single reviewer)

Summary

Standards-sync PR deploying 6 org-standard workflow caller stubs verbatim from petry-projects/.github. Changes are: (1) repointing all reusable uses: refs to a single first-party SHA 376a4fcb (annotated with /stable channel comments), (2) comment/documentation updates clarifying the stable-channel versioning policy, and (3) a documented permissions broadening on dependabot-rebase.yml (adds contents: write so the reusable can run update-branch via GITHUB_TOKEN). All reusables are SHA-pinned to the first-party org repo — the secure pinning pattern.

Linked issue analysis

No linked issue (closingIssuesReferences empty). This is an automated standards-sync opened by scripts/deploy-standard-workflows.sh, carrying the standards-sync label; no issue is expected.

Findings

No blocking findings.

• All uses: refs are pinned to full 40-char SHAs of first-party petry-projects/.github reusables (secure; channel name is comment-only).
• dependabot-rebase.yml gains contents: write — necessary and documented for branch-update via GITHUB_TOKEN; consistent with the auto-rebase stub.
• No literal secrets in the diff; only ${{ secrets.APP_ID }}/APP_PRIVATE_KEY expressions.
• MCP secret scanning unavailable (no GitHub Advanced Security); gitleaks CI check passed.
• Advisory bots non-blocking: SonarCloud quality gate passed (0 new issues); Codex/CodeRabbit rate-limited; Gemini unsupported file types.

CI status

All required checks green: Lint, Format, Test, CodeQL, Analyze (actions), agent-shield/AgentShield, Secret scan (gitleaks), SonarCloud, review, dev-lead/dispatch, pr-auto-review. Conditional dependency-audit/dependabot jobs SKIPPED as expected. mergeStateStatus is BLOCKED pending this review (REVIEW_REQUIRED).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/auto-rebase.yml:
- Around line 9-13: The header comment in the auto-rebase workflow file
contradicts the actual implementation. Lines 9-13 state that the uses ref must
be pinned to the auto-rebase/stable channel and warn against using SHAs, but
line 53 actually pins the uses ref to a full SHA. Update the header comment
(lines 9-13) to accurately reflect that the uses ref is pinned to a specific SHA
rather than a moving tag, ensuring the documented standards align with the
actual pinning model being used.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7772a7e7-adac-4318-bbd7-f29603400816

📥 Commits

Reviewing files that changed from the base of the PR and between 5cb1f9b and c1e9a19.

📒 Files selected for processing (6)

• .github/workflows/agent-shield.yml
• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dependabot-rebase.yml
• .github/workflows/dependency-audit.yml
• .github/workflows/pr-review-mention.yml

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #293
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-20T02:15:41Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-20T02:15:41Z

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-20T02:46:26Z.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate (main branch)
Root cause: Lint/style

The SonarCloud Quality Gate failed on the main branch because 10 new Security Hotspots were detected by static analysis. Security Hotspots are code patterns that require human review to determine whether they represent real vulnerabilities. This check is scoped to the main branch analysis (not the PR diff itself), meaning hotspots accumulated from prior merged code are now breaching the gate threshold.

Suggested fix: Open the SonarCloud Security Hotspots dashboard and triage each of the 10 hotspots — mark them as "Safe" if they are false positives, or open issues and fix the ones that are genuine risks.

View run logs