[Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged)

Parent: #497 · Work type: Infra · Fan-out (B), ring-staged.

Convert the 4 consumer repos (bmad-bgreat-suite, google-app-scripts, markets, ContentTwin) from vendored copies (the deploy clobber) to thin reusable callers pinned to @pr-review/stable (and @dev-lead/stable). Stage by ring: ring 1 = one low-traffic consumer first, validate healthy, then ring 2 = the rest.

Acceptance: no consumer runs @main or a vendored copy; each pins a channel tag; DON_PETRY_BOT_GH_PAT_CLASSIC (visibility=all) reaches them. Retire deploy-pr-review.yml/force-deploy-pr-review.yml once converted.

Blocked-by dev-lead self-host (so dev-lead/stable is a real pinned release before consumers reference it).

Re-scoped + unblocked from #535. Consumers already call the wrapper pr-review-reusable.yml@main with secrets: inherit, but the wrapper (a) pins pr-review.yml@main (bleeding), (b) passes no agent_ref (scripts unpinned, #506), and (c) drops DON_PETRY_BOT_GH_PAT_CLASSIC (its explicit secret list omits it) → consumers can't approve. Fix per consumer: call pr-review.yml@pr-review/stable directly with agent_ref: pr-review/stable + secrets: inherit (mirrors .github-private's pr-review-trigger.yml). Ring 1 = one low-traffic consumer, validate, then ring 2. The dev-lead consumer pinning (@dev-lead/stable) is tracked separately and stays gated on #535.

ci(pr-review): pin to @pr-review/stable channel (ring-1 fan-out) (#262)

Ring-1 (markets) surfaced a real bug (the value of ring-staging): pr-review.yml's 'Checkout agent repo' cloned the caller's repo (no repository:), so consumer runs tried markets@pr-review/stable (no such ref) → checkout failure. Worked for self-host only because the caller was .github-private. Fixed in PR #538 (explicit repository: petry-projects/.github-private). Will promote to v1.5.0 and re-validate markets#261 before ring-2.

fix(pr-review): checkout the agent repo explicitly, not the caller (#536

fix(ci-status): filter own-checks by workflowName (covers consumer fo…

Ring-2 fan-out progress (2026-06-10)

Ring-1 (validated earlier): markets → @pr-review/stable (markets#262, merged). 3 latent fleet bugs caught & fixed: #538 (agent-repo checkout), #539 (own-check filter by workflowName), wrapper's dropped classic-PAT/triggers.

Ring-2 lead — bmad-bgreat-suite (definitive fresh-approval validation):

Dispatched converted @pr-review/stable caller (from branch) against clean dependabot [Fleet Monitor] petry-projects/.github-private — actions-fleet-monitor.yml #274 → donpetry-bot posted a fresh APPROVED review at 2026-06-10T11:34:27Z (+2m23s after dispatch), marker pr-review-agent v1 decision=approved risk=LOW; PR flipped REVIEW_REQUIRED → APPROVED. Conclusive end-to-end proof: pinned channel + agent_ref + classic PAT via secrets: inherit all work on a ring-2 consumer.
Correctly no-op'd feat: Phase 0 — install and initialize gh-aw in .github-private #276 (ci-failing: cancelled checks from concurrency thrash, pr-review: per-PR cancel-in-progress cancels racing runs (concurrency thrash) #534) — gate behaving correctly.

Ring-2 rollout status:

Repo	PR	State
ContentTwin	#251	✅ merged to main (all required checks green; OrgAdmin bypass)
google-app-scripts	#377	✅ merged to main (all required checks green)
bmad-bgreat-suite	#290	⚠️ validated & ready, merge-blocked by broken `CodeQL` required check (advanced/default conflict, #272) — no ruleset bypass for required status checks, and CodeQL never reports

Acceptance: 3/4 consumers (markets, ContentTwin, google-app-scripts) now run @pr-review/stable directly — no @main, no vendored copy. bmad blocked only by pre-existing CodeQL infra debt (#272), not the conversion.

Observation (latent, not actioned): the agent's CI gate treats non-required failing checks (e.g. SonarCloud Code Analysis, which isn't in any ruleset's required list) as ci-failing, so it won't self-approve mergeable PRs. Candidate hardening: align the gate to required checks only.

🤖 Generated with Claude Code

Ring-2 COMPLETE — all 4 consumers on `@pr-review/stable` (2026-06-10)

Repo	PR	State
markets	#262	✅ merged (ring-1)
ContentTwin	#251	✅ merged + smoke-validated on main
google-app-scripts	#377	✅ merged + smoke-validated on main
bmad-bgreat-suite	#290	✅ merged + smoke-validated on main

Acceptance met: no consumer runs @main or a vendored copy; each pins the pr-review/stable channel with agent_ref; DON_PETRY_BOT_GH_PAT_CLASSIC reaches them via secrets: inherit. Promotions now roll out by moving the channel tag centrally — zero caller churn.

bmad unblock (side quest): bmad#290 was deadlocked because the required CodeQL check had no producer (default-setup not-configured, no codeql.yml), and the rulesets have no bypass for required status checks — so every bmad PR was stuck. Fixed by enabling CodeQL default setup (actions language) via the code-scanning API. This is exactly what issue #47 / PR #239 (codeql-default-setup-not-configured) targeted — those, plus competing PR #281 (advanced codeql.yml) and #272, should be reconciled/closed now that default setup is live. This unblocks bmad's full PR backlog (~30 PRs), not just the conversion.

Still open (Phase-1 remainder, not ring-2):

Retire deploy-pr-review.yml / force-deploy-pr-review.yml (the old vendor-clobber mechanism [Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged) #536 acceptance calls out).
dev-lead inline→stub reconciliation + @dev-lead/stable consumer conversion ([Fan-out] dev-lead self-host pin (trigger stub + reusable-only + agent_ref) #535).
Concurrency thrash relax (pr-review: per-PR cancel-in-progress cancels racing runs (concurrency thrash) #534) — observed cancelling runs throughout this rollout.

🤖 Generated with Claude Code

chore: retire deploy-pr-review, force-deploy, and pr-review-reusable …

#536 acceptance fully met ✅

Cleanup complete (#542, merged): retired deploy-pr-review.yml, force-deploy-pr-review.yml, and the orphaned pr-review-reusable.yml wrapper. The vendor-clobber/indirection delivery mechanism is gone; channel-tag promotion replaces it.

Notably, #542 self-approved through the ring-0 agent (fresh donpetry-bot APPROVED @ 12:39:29Z) and auto-merged on green — the self-host loop now works end-to-end on .github-private without admin override (it just needed the #534-thrash-cancelled dev-lead checks re-run first).

Acceptance checklist

No consumer runs @main or a vendored copy — all 4 pin @pr-review/stable with agent_ref
DON_PETRY_BOT_GH_PAT_CLASSIC reaches them via secrets: inherit
Retire deploy-pr-review.yml / force-deploy-pr-review.yml (+ pr-review-reusable.yml)

Surfaced for follow-up (separate issues)

pr-review: per-PR cancel-in-progress cancels racing runs (concurrency thrash) #534 concurrency thrash — repeatedly cancelled dev-lead/review checks throughout this rollout, and (via the gate quirk below) blocked agent self-approval until manually cleared. Highest-friction item; worth relaxing per-PR cancel-in-progress for the review group.
Agent CI-gate hardening — the gate counts non-required failing/cancelled checks as ci-failing, so the agent declines otherwise-mergeable PRs. Align to required checks only.
bmad CodeQL — default setup now enabled (actions); reconcile/close competing config PRs [Fleet Monitor] petry-projects/broodly — dependency-audit.yml #239/[Fleet Monitor] petry-projects/.github-private — copilot-pull-request-reviewer #272/fix(dev-lead): git identity not configured + commit failure silently swallowed + missing WebFetch tool access #281.
[Fan-out] dev-lead self-host pin (trigger stub + reusable-only + agent_ref) #535 — dev-lead inline→stub + @dev-lead/stable consumer conversion (next Phase-1 item).

Ready to close once you've eyeballed it.

🤖 Generated with Claude Code

fix(pr-review): checkout the agent repo explicitly, not the caller (#536

chore: retire deploy-pr-review, force-deploy, and pr-review-reusable …

Navigation Menu

Repository navigation

[Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged) #536

Ring-2 fan-out progress (2026-06-10)

Ring-2 COMPLETE — all 4 consumers on `@pr-review/stable` (2026-06-10)

#536 acceptance fully met ✅

Acceptance checklist

Surfaced for follow-up (separate issues)

33 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Fan-out] Convert consumers' pr-review to @pr-review/stable callers (ring-staged) #536

Description

Activity

don-petry commented on Jun 10, 2026

don-petry commented on Jun 10, 2026

don-petry commented on Jun 10, 2026

Ring-2 fan-out progress (2026-06-10)

don-petry commented on Jun 10, 2026

Ring-2 COMPLETE — all 4 consumers on @pr-review/stable (2026-06-10)

don-petry commented on Jun 10, 2026

#536 acceptance fully met ✅

Acceptance checklist

Surfaced for follow-up (separate issues)

33 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Ring-2 COMPLETE — all 4 consumers on `@pr-review/stable` (2026-06-10)