fix: address CodeRabbit review on PR #89

[v-Kaefer]

Linked Issue

• Closes feat: GitHub App authentication and native ruleset reconciliation #91 (stacked on feat: add GitHub App auth and ruleset reconciliation #89 / feat/github-app-rulesets)

Milestone

• M1

Summary

Applies the CodeRabbit review findings from #89 plus an extra security pass.

Arquivo	Correção
.github/workflows/rulesets.yml	CWE-78 / template-injection: workflow_dispatch inputs (confirmation, mode) agora passam por env: em vez de serem interpolados no shell.
project_setup/rulesets.py	plan-id agora inclui repo + ações resolvidas + ruleset IDs, impedindo reuso de confirmação entre repos e após drift create→update.
config/governance/rulesets.json	Removido o time maintainers hard-coded do template default; bypassActors: [] + nota de substituição.
project_setup/cli.py	Handlers live resolvem repo_arg(args.repo) antes de criar o client e o repassam a require_client/require_project_client.
README.md	Reconciliada a fronteira de auth do GitHub App para Projects v2; removida a limitação obsoleta "rulesets are not created".
tests/test_rulesets.py	Cobertura para reuso de confirmação entre repos e drift create→update.

How to test

• Test type: automated
• Steps:
  • python3 scripts/validation/repo_quality.py
  • python3 -B -m unittest discover -s tests -p "test_*.py" -v

Evidence

• Log/output attached when applicable — Ran 116 tests ... OK

Known risks

• Nenhum risco funcional novo. Mudanças de auth exigem que as credenciais do GitHub App estejam configuradas antes do uso live em organização (já documentado no feat: add GitHub App auth and ruleset reconciliation #89).

DoD checklist

• Scope implemented as defined
• Tests executed and documented
• No known critical breakage introduced

Security pass adicional

• pr-sync.yml (pull_request_target): seguro — só roda para PRs do mesmo repo, checkout apenas do base com persist-credentials: false, nunca faz checkout do PR-head.
• project-setup.yml: todos os inputs são type: boolean, sem risco de injeção.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• develop
• Q.A.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1280e484-30a6-4499-a2f9-8826e19a5784

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR Sync

• Linked task: feat: GitHub App authentication and native ruleset reconciliation #91
• PR lifecycle target: Done
• Project v2: synced to Done in Project v2 Refactor repository automation into project_setup #6.
• Parent/sub-issue: no parent reference found.
• PR: fix: address CodeRabbit review on PR #89 #94