chore(workflows): adopt centralized stubs from petry-projects/.github by don-petry · Pull Request #52 · petry-projects/ContentTwin

don-petry · 2026-04-08T03:40:40Z

Summary

Replaces inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to the org-level reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1.

Files changed (4)

.github/workflows/claude.yml → stub for claude-code-reusable.yml@v1
.github/workflows/dependency-audit.yml → stub for dependency-audit-reusable.yml@v1
.github/workflows/dependabot-automerge.yml → stub for dependabot-automerge-reusable.yml@v1
.github/workflows/dependabot-rebase.yml → stub for dependabot-rebase-reusable.yml@v1

Net: 376 lines removed, 89 added.

Why

Future updates to the standard propagate automatically without per-repo PRs, and drift is caught by the org-wide compliance audit (petry-projects/.github#89).

See petry-projects/.github#87 (build reusables), petry-projects/.github#88 (pin to v1, document tier model), petry-projects/.github#89 (audit drift detection).

Test plan

actionlint clean
CI on this branch — claude / dependabot-automerge / dependency-audit jobs should run via the reusables exactly as before

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Consolidated GitHub Actions workflows to reference organization-maintained, versioned reusable workflows for improved consistency and maintainability:
  - Claude Code analysis updated to v1 external workflow reference
  - Dependabot automerge, rebase, and dependency audit operations now use centralized reusable workflows

Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-04-08T03:40:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a6f941dc-a5b7-4fb6-9d5f-8a266f77571b

📥 Commits

Reviewing files that changed from the base of the PR and between e798a8c and 46ed259.

📒 Files selected for processing (4)

.github/workflows/claude.yml
.github/workflows/dependabot-automerge.yml
.github/workflows/dependabot-rebase.yml
.github/workflows/dependency-audit.yml

📝 Walkthrough

Walkthrough

Four GitHub Actions workflow files are refactored to delegate job execution to organization-level reusable workflows pinned to version @v1 instead of using inline implementations or @main references. This consolidates repetitive workflow logic into centralized, versioned templates across the repository.

Changes

Cohort / File(s)	Summary
Workflow Migration to Reusable Workflows `.github/workflows/claude.yml`, `.github/workflows/dependabot-automerge.yml`, `.github/workflows/dependabot-rebase.yml`, `.github/workflows/dependency-audit.yml`	All four workflows refactored to delegate to org-level reusable workflows (`@v1`). `claude.yml` updates reference from `@main` to `@v1` with added documentation; `dependabot-automerge.yml` replaces inline job with reusable workflow call; `dependabot-rebase.yml` removes shell script-based update/merge logic (~114 lines); `dependency-audit.yml` consolidates six ecosystem-specific jobs into single reusable workflow delegation (~204 lines removed).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

petry-projects/ContentTwin#40 — Delegates claude.yml job to org reusable workflow at @main; this PR bumps that reference to @v1 and adds documentation.
petry-projects/ContentTwin#39 — Modifies .github/workflows/claude.yml to restructure the claude job into multiple variants.
petry-projects/ContentTwin#5 — Introduces .github/workflows/claude.yml workflow; this PR updates its reusable workflow reference and adds comments.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'chore(workflows): adopt centralized stubs from petry-projects/.github' directly and clearly summarizes the main change: replacing inline workflows with caller stubs that delegate to centralized organization-level reusable workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/adopt-centralized-workflow-stubs

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sonarqubecloud · 2026-04-08T03:41:23Z

Quality Gate failed

Failed conditions
6 Security Hotspots

See analysis details on SonarQube Cloud

Copilot

Pull request overview

This PR replaces locally-copied GitHub Actions workflows with thin caller stubs that delegate to org-level reusable workflows in petry-projects/.github, aiming to reduce drift and centralize maintenance.

Changes:

Swap inline workflow logic for reusable workflow callers (uses: petry-projects/.github/...@v1) across Claude, Dependabot, and dependency-audit workflows.
Add standardized “SOURCE OF TRUTH”/“AGENTS — READ BEFORE EDITING” headers to each workflow file.
Update the Claude workflow to use claude-code-reusable.yml@v1 instead of @main.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 5 comments.

File	Description
.github/workflows/claude.yml	Converts to a thin stub calling the org reusable at `@v1` and keeps required permissions/secrets inheritance.
.github/workflows/dependency-audit.yml	Replaces ecosystem detection/audit jobs with a single reusable-workflow call and updates documentation header.
.github/workflows/dependabot-automerge.yml	Converts to a thin stub calling the org reusable at `@v1`, inheriting secrets and retaining job-level permissions.
.github/workflows/dependabot-rebase.yml	Converts to a thin stub calling the org reusable at `@v1`, inheriting secrets and retaining concurrency/permissions.

Comments suppressed due to low confidence (1)

.github/workflows/dependency-audit.yml:34

This references the reusable workflow via @v1, which is not an immutable commit SHA. For supply-chain hardening (and to match the repo’s general practice of pinning actions to SHAs), consider pinning to a specific commit SHA, or ensure v1 is a protected/immutable ref per org policy.

jobs:
  dependency-audit:
    uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T03:44:32Z

-# Copy to .github/workflows/dependency-audit.yml
+# ─────────────────────────────────────────────────────────────────────────────
+# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml
+# Standard:        petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym


The anchor in the “Standard:” reference looks truncated (ends with dependency-auditym). If this is meant to link to the dependency-audit.yml section, update the fragment so it matches the actual filename/heading (likely ending in ...dependency-audityml).

Suggested change

# Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym

# Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-audityml

Copilot · 2026-04-08T03:44:32Z

+# Add "dependency-audit / Detect ecosystems" as a required status check
+# in branch protection.


The required-status-check instruction appears inconsistent with this workflow’s name: (Dependency audit). GitHub required checks typically use the check run name (often Workflow name / Job name), so dependency-audit / Detect ecosystems may be misleading. Please verify the actual check name produced by the reusable and update this comment to match what branch protection expects.

Suggested change

# Add "dependency-audit / Detect ecosystems" as a required status check

# in branch protection.

# Add the actual check run reported by this workflow in GitHub as a required

# status check in branch protection.

Copilot · 2026-04-08T03:44:33Z

 jobs:
  claude-code:
-    uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@main
+    uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@v1


This references the reusable workflow via @v1, which is not an immutable commit SHA. For supply-chain hardening (and to match the repo’s general practice of pinning actions to SHAs), consider pinning to a specific commit SHA, or ensure v1 is a protected/immutable ref per org policy.

Suggested change

uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@v1

uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@0123456789abcdef0123456789abcdef01234567

Copilot · 2026-04-08T03:44:33Z

-
-          # Queue auto-merge (waits for all checks to pass)
-          gh pr merge --squash --auto "$PR_URL"
+    uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1


This references the reusable workflow via @v1, which is not an immutable commit SHA. For supply-chain hardening (and to match the repo’s general practice of pinning actions to SHAs), consider pinning to a specific commit SHA, or ensure v1 is a protected/immutable ref per org policy.

Suggested change

uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1

uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@FULL_40_CHARACTER_COMMIT_SHA_FOR_THE_APPROVED_V1_REVISION

Copilot · 2026-04-08T03:44:33Z

-              echo "  Warning: failed to merge PR #$PR_NUMBER"
-            fi
-          done <<< "$PRS"
+    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@v1


This references the reusable workflow via @v1, which is not an immutable commit SHA. For supply-chain hardening (and to match the repo’s general practice of pinning actions to SHAs), consider pinning to a specific commit SHA, or ensure v1 is a protected/immutable ref per org policy.

Suggested change

uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@v1

uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@<FULL_40_CHARACTER_COMMIT_SHA_FOR_THE_CURRENT_V1_REVISION>

…#52) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@v1

…deation.yml-permissions (#371) * Add Claude Code GitHub Action (#5) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#12) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#8) - Scope workflow token permissions (#9) - Add Dependabot configuration (#10) - Ensure SAST runs on all commits (#11) Closes #8, #9, #10, #11 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use correct CodeQL action commit SHA The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add actions: read to CodeQL workflow permissions - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 3.35.1 to 4.35.1 (#15) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump actions/checkout from 4.2.2 to 6.0.2 (#16) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.2.2...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump anthropics/claude-code-action from 1.0.80 to 1.0.81 (#13) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.81. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...e7b588b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.81 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#30) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input - Add dependabot skip condition on step - Add permission comment for contents: write Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#31) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#39) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#40) * feat: add workflow to create code-quality repository ruleset Creates the required 'code-quality' branch ruleset with SonarCloud as a required status check on the default branch. This workflow runs on every push to main (idempotent) to ensure the ruleset stays in sync. Closes #28 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * revert: remove workflow approach - cannot push workflow files * chore(workflows): adopt centralized stubs from petry-projects/.github (#52) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 (#84) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#114) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#114)" This reverts commit d49958d. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 (#122) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump github/codeql-action from 4.35.3 to 4.35.4 (#138) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore: delete stray codeql.yml workflow (#107) * chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * ci: remove drift codeql.yml — GitHub-managed default setup is active (#98) retrigger: bump workflows to run checks Co-authored-by: Claude <claude@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#156) * fix(compliance): enable delete_branch_on_merge repository setting (#102) * fix(compliance): enable delete_branch_on_merge repository setting Apply the `delete_branch_on_merge` repository setting required by org standards (standards/github-settings.md#merge-settings). This is a repository-level setting applied via the GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin \ -f delete_branch_on_merge=true # confirmed: true Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: update code-quality ruleset to full required check list (#100) * fix: update code-quality ruleset to full required check list Add all required status checks to scripts/setup-rulesets.sh: - SonarCloud, Analyze (actions), Lint, Format - agent-shield / AgentShield, dependency-audit / Detect ecosystems Explicitly excludes claude-code / claude (see comment) to avoid deadlocking workflow-modifying PRs. Also enables strict_required_status_checks_policy to match the live ruleset. Closes #81 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix(compliance): enable delete_branch_on_merge repository setting (#95) * fix(compliance): enable delete_branch_on_merge repository setting The repository setting `delete_branch_on_merge` must be enabled per org standards (standards/github-settings.md#repository-settings--standard-defaults). Applied via GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin -f delete_branch_on_merge=true This is a repository-level setting, not a file change. The next weekly compliance audit will verify the fix and auto-close this finding. Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: pin dependabot-automerge reusable workflow to SHA (#90) * fix: pin dependabot-automerge reusable workflow to SHA Pins petry-projects/.github reusable workflow from @v1 to commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (v1) to satisfy the action-pinning policy. Closes #58. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #146 — Compliance: secret_scanning_non_provider_patterns (#170) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #134 — Compliance: check-suite-auto-trigger-347564 (#167) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #147 — Compliance: dependabot_security_updates (#166) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml (#165) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #143 — Compliance: non-stub-dependabot-automerge.yml (#164) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #133 — Compliance: check-suite-auto-trigger-1236702 (#172) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #142 — Compliance: codeowners-org-leads-not-first (#163) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #174 — [Fleet Monitor] petry-projects/ContentTwin — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #131 — Compliance: codeowners-no-catchall (#162) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #144 — Compliance: non-stub-pr-review-mention.yml (#177) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#211) * rollout: deploy pr-review-mention standard workflow * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: correct pr-auto-review reusable workflow reference (#219) * fix: correct pr-auto-review reusable workflow reference * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow (#222) Co-authored-by: Claude Code Bot <noreply@anthropic.com> * feat: implement issue #205 — Compliance: gitignore_secrets_block (#230) * feat: implement issue #205 — Compliance: gitignore_secrets_block * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable (#291) * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github (#293) * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#308) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#327) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#328) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #342 — Compliance: dev-lead-stub-agent-ref (#349) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#366) * chore: insert org secrets baseline in .gitignore * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #346 — Compliance: stub-surface-drift-feature-ideation.yml-permissions * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix: restore secrets-baseline END sentinel and add-to-project trailing newline Reverts two accidental truncation hunks unrelated to issue #346, per the automated review: .gitignore's org-managed secrets-baseline closing sentinel must not be edited, and the add-to-project.yml stub newline removal was pointless drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings April 8, 2026 03:40

Copilot started reviewing on behalf of don-petry April 8, 2026 03:41 View session

Copilot AI reviewed Apr 8, 2026

View reviewed changes

don-petry merged commit c9d2a06 into main Apr 8, 2026
17 of 19 checks passed

don-petry deleted the chore/adopt-centralized-workflow-stubs branch April 8, 2026 03:46

don-petry mentioned this pull request Apr 8, 2026

Missing APP_ID / APP_PRIVATE_KEY secrets — dependabot-rebase workflow fails #53

Closed

coderabbitai Bot mentioned this pull request Apr 21, 2026

Revert: Restore required double .github/ in reusable workflow paths #115

Merged

This was referenced May 4, 2026

chore: update dependabot-rebase-reusable SHA (fix update-branch + mergeable) #127

Merged

fix(ci): sync dependabot-rebase.yml with canonical org stub #136

Closed

This was referenced Jun 8, 2026

feat: implement issue #194 — Compliance: non-stub-dependency-audit.yml #235

Merged

feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml #252

Closed

This was referenced Jun 19, 2026

feat: implement issue #285 — Compliance: non-stub-dependabot-automerge.yml #288

Closed

chore: sync 6 org-standard workflow stub(s) from petry-projects/.github #293

Merged

feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml #294

Closed

Navigation Menu

Repository navigation

chore(workflows): adopt centralized stubs from petry-projects/.github - #52

chore(workflows): adopt centralized stubs from petry-projects/.github#52
don-petry merged 1 commit into
mainfrom
chore/adopt-centralized-workflow-stubs

don-petry commented Apr 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 8, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

sonarqubecloud Bot commented Apr 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	# Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym
	# Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-audityml

		# Add "dependency-audit / Detect ecosystems" as a required status check
		# in branch protection.

	uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@v1
	uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@0123456789abcdef0123456789abcdef01234567

Conversation

don-petry commented Apr 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Files changed (4)

Why

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Uh oh!

sonarqubecloud Bot commented Apr 8, 2026

Quality Gate failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

don-petry commented Apr 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 8, 2026 •

edited

Loading