[don-petry]

Pins the petry-projects/.github reusable workflow reference in .github/workflows/dependabot-automerge.yml from @v1 to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 (with a # v1 comment for readability), satisfying the action-pinning compliance policy.

Changes

• .github/workflows/dependabot-automerge.yml: pin uses: reference to SHA

Verification

SHA looked up via:

gh api repos/petry-projects/.github/git/refs/tags/v1 --jq '.object.sha'
# → 0cb4bba11d7563bf197ad805f12fb8639e4879e4

Closes #116

Generated with Claude Code

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 39 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ce84867e-49d0-4f5f-a09c-58c9d3dc4e08

📥 Commits

Reviewing files that changed from the base of the PR and between dde4dcb and 3583468.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-116-20260511-2018

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

@petry-projects/org-leads — this PR pins the dependabot-automerge.yml reusable workflow reference to a SHA to resolve the action-pinning compliance finding in #116. The change is minimal and verified. Please review and merge when ready.

Pull request overview

Pins the Dependabot automerge thin-caller workflow to a specific commit SHA to satisfy the org action/workflow pinning compliance policy (closing #116).

Changes:

• Update the reusable workflow uses: reference in .github/workflows/dependabot-automerge.yml from @v1 to a full commit SHA.
• Add a trailing # v1 comment to preserve human-readable version context while remaining pinned.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: a4bb347a48b8912a4db89c4d42b88a3736a5c9af
Review mode: triage-approved (single reviewer)

Summary

One-line change in .github/workflows/auto-rebase.yml pinning the org-level reusable workflow petry-projects/.github/.github/workflows/auto-rebase-reusable.yml from the floating tag @v1 to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4, with a trailing # v1 comment preserving the human-readable version. This is a security/compliance improvement (action pinning) with no behavioural change. Triage classified this as low-risk; on confirmation review the assessment holds.

Linked issue analysis

Resolves #115 — a weekly compliance-audit finding for unpinned-actions-auto-rebase.yml flagging the @v1 reference as a violation of standards/ci-standards.md#action-pinning-policy. The PR pins the exact action called out in the finding, and only that action. Closing-keyword Closes #115 is present in the PR body.

Findings

• SHA verification (pass): Queried gh api repos/petry-projects/.github/git/refs/tags/v1 — the v1 tag currently points to 0cb4bba11d7563bf197ad805f12fb8639e4879e4, matching the value pinned here.
• Format (pass): Uses the recommended <sha> # <tag> pattern, preserving the floating-tag intent as a comment for human readers and future bumps.
• Editing rules (pass): The thin-stub header in this file explicitly permits changing the SHA in the uses: line when upgrading the reusable; it forbids changes to triggers, concurrency group, or the permissions: block — none of those are touched.
• Permissions/secrets (pass): permissions: and secrets: inherit are unchanged.
• Nit (pre-existing, not introduced): The file still lacks a trailing newline (the diff's \ No newline at end of file marker reflects the file's existing state). Not blocking; flagging for the next touch of this file.

CI status

All required checks green: AgentShield, Claude Code, CodeQL (Analyze actions + CodeQL aggregate), Dependency audit (detect ecosystems; language-specific jobs correctly skipped — no app code), SonarCloud (Quality Gate passed, 0 new issues), CodeRabbit status context green. Dependabot-automerge skipped as expected (non-Dependabot PR). mergeStateStatus is BLOCKED only because human approval is still required per branch protection — not a CI failure.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud