From 9ce0c8ab84d0fc58de7374043bb202af9603ad4b Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:44:09 +0000 Subject: [PATCH 1/7] chore: sync 4 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/dev-lead.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index 385fd58fe..64793e859 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -67,9 +67,9 @@ jobs: # Promotion is done by moving the channel tags centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent. - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-next # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: dev-lead/v139-stable + agent_ref: dev-lead/v139-next secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable permissions: contents: write From b0b10ae528972d69a1bd70b254f78eb30032c2e0 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:44:11 +0000 Subject: [PATCH 2/7] chore: sync 4 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/agent-shield.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 5887d518b..045f06176 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -30,4 +30,4 @@ permissions: jobs: agent-shield: - uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-next # NOSONAR(githubactions:S7637) first-party channel ref From 47a2f1fd92f20804a65c3b5f323996c2604c3fef Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:44:12 +0000 Subject: [PATCH 3/7] chore: sync 4 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/add-to-project.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index d5b20a58e..b92b009dd 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -47,11 +47,11 @@ jobs: add-to-project: permissions: contents: read - uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-next # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/petry-projects/projects/1 - agent_ref: add-to-project/v1-stable + agent_ref: add-to-project/v1-next # Pass only the secrets the reusable declares (least privilege; avoids # `secrets: inherit` handing the reusable every org secret). secrets: From 9c8c405d632534a4ada5a3288c96479d6167b15f Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Mon, 28 Sep 2026 16:44:13 +0000 Subject: [PATCH 4/7] chore: sync 4 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/pr-auto-review.yml | 37 ++++++++++++++++++---------- 1 file changed, 24 insertions(+), 13 deletions(-) diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index 49bd1eb9f..d889668a5 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -8,7 +8,7 @@ # reusable workflow above. # • You MAY change: the workflow name(s) in `workflow_run.workflows` to match # your repository's CI workflow name(s). -# • You MUST NOT change: the `@pr-auto-review/v1-next` channel in the `uses:` +# • You MUST NOT change: the `@pr-auto-review/v1-stable` channel in the `uses:` # line — this reusable is on the org-wide moving-channel model (rollout and # rollback are a single central tag move; a frozen `@vN`/`@` pin is # rejected by the compliance audit). Nor the trigger event types or the @@ -44,20 +44,31 @@ on: permissions: {} +# Deduplicate ONLY the default-branch-context triggers (issue #1126). On GitHub +# Free (20 concurrent jobs, org-wide) this stub fanned out per trigger. Its runs +# split by context: +# • check_suite / workflow_run — head_branch=main, the check does NOT attach to +# the PR head, so superseding an in-flight run is SAFE. Both events collapse +# onto one group per PR (`…-pr-`) with cancel-in-progress: true. +# • pull_request / pull_request_review — run on the PR head; a cancelled run +# would leave a cancelled `pr-auto-review / check-and-dispatch` check on the +# head. They get a unique-per-run group and never cancel, so they behave +# exactly as before. +# A default-branch trigger with no associated PR (fork / no PR) also falls back to +# the unique-per-run group so unrelated PRs never collapse into one group. +concurrency: + group: >- + ${{ + (github.event_name == 'check_suite' && github.event.check_suite.pull_requests[0].number) + && format('pr-auto-review-ready-check-pr-{0}', github.event.check_suite.pull_requests[0].number) + || (github.event_name == 'workflow_run' && github.event.workflow_run.pull_requests[0].number) + && format('pr-auto-review-ready-check-pr-{0}', github.event.workflow_run.pull_requests[0].number) + || format('pr-auto-review-ready-check-unique-{0}', github.run_id) + }} + cancel-in-progress: ${{ github.event_name == 'check_suite' || github.event_name == 'workflow_run' }} + jobs: pr-auto-review: - # Skip Dependabot-authored events (#1390, mirrors the #864 guard in - # dev-lead-reusable.yml): a Dependabot `pull_request` run has no access to - # GH_PAT_WORKFLOWS, so the secrets expression below resolves empty and the - # reusable's ready-check checkout fails at startup with - # "Input required and not supplied: token". Dependabot PRs are handled by - # dependabot-automerge.yml and never need the review-agent dispatch, so - # skipping cleanly here removes the false failure without touching the - # channel, trigger event types, or permissions block. - # Two conditions: actor covers Dependabot-triggered events (pull_request, - # workflow_run); PR-author login covers pull_request_review events where the - # actor is the human reviewer, not Dependabot. - if: github.actor != 'dependabot[bot]' && github.event.pull_request.user.login != 'dependabot[bot]' permissions: pull-requests: read checks: read From fda841ff65e948704ee573ab83ea99f520b0a499 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 29 Sep 2026 19:01:08 +0000 Subject: [PATCH 5/7] fix: restore stable channel tags in workflow stubs Revert workflow stubs from next to stable channel tags. The standards sync incorrectly promoted these to next channels when they should remain on stable for production use and safe release compliance. - agent-shield.yml: @agent-shield/v2-stable - dev-lead.yml: @dev-lead/v139-stable (required stable per SC2 #503) - pr-auto-review.yml: @pr-auto-review/v1-stable - add-to-project.yml: @add-to-project/v1-stable Co-Authored-By: Claude Haiku 4.5 --- .github/workflows/add-to-project.yml | 4 ++-- .github/workflows/agent-shield.yml | 2 +- .github/workflows/dev-lead.yml | 4 ++-- .github/workflows/pr-auto-review.yml | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index b92b009dd..d5b20a58e 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -47,11 +47,11 @@ jobs: add-to-project: permissions: contents: read - uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-next # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/petry-projects/projects/1 - agent_ref: add-to-project/v1-next + agent_ref: add-to-project/v1-stable # Pass only the secrets the reusable declares (least privilege; avoids # `secrets: inherit` handing the reusable every org secret). secrets: diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 045f06176..5887d518b 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -30,4 +30,4 @@ permissions: jobs: agent-shield: - uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-next # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index 64793e859..385fd58fe 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -67,9 +67,9 @@ jobs: # Promotion is done by moving the channel tags centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent. - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-next # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v139-stable # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: dev-lead/v139-next + agent_ref: dev-lead/v139-stable secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable permissions: contents: write diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index d889668a5..73df2cea4 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -73,7 +73,7 @@ jobs: pull-requests: read checks: read actions: read - uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-next # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: # Canonical-first fallback (.github-private#1326). The reusable resolves this # secret BY NAME, so only the VALUE changes — the passed key stays named From 572fbe4f872a3a6aaaf6a5ba5ce219e33774df67 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 29 Sep 2026 19:01:23 +0000 Subject: [PATCH 6/7] fix: restore Dependabot exclusion in pr-auto-review workflow Add the job-level condition to skip pr-auto-review runs when either the PR actor or pull request author is dependabot[bot]. This prevents automated Dependabot PRs from triggering unnecessary review cycles. Co-Authored-By: Claude Haiku 4.5 --- .github/workflows/pr-auto-review.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index 73df2cea4..420c83440 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -69,6 +69,7 @@ concurrency: jobs: pr-auto-review: + if: github.actor != 'dependabot[bot]' && github.event.pull_request.user.login != 'dependabot[bot]' permissions: pull-requests: read checks: read From f64756428b06f954b8091e520bc10be1f61eb195 Mon Sep 17 00:00:00 2001 From: don-petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 29 Sep 2026 19:11:41 +0000 Subject: [PATCH 7/7] fix(reviews): address review comments [skip ci-relay] --- .github/workflows/test-dev-lead.yml | 2 +- tests/dev-lead/integration/test_pr_auto_review_stub.py | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/test-dev-lead.yml b/.github/workflows/test-dev-lead.yml index 802f28ca7..5922fdc51 100644 --- a/.github/workflows/test-dev-lead.yml +++ b/.github/workflows/test-dev-lead.yml @@ -268,5 +268,5 @@ jobs: persist-credentials: false - name: Install PyYAML run: python3 -m pip install --quiet --only-binary ":all:" pyyaml==6.0.3 - - name: Validate pr-auto-review.yml skips Dependabot and pins @pr-auto-review/v1-next + - name: Validate pr-auto-review.yml skips Dependabot and pins @pr-auto-review/v1-stable run: python3 tests/dev-lead/integration/test_pr_auto_review_stub.py diff --git a/tests/dev-lead/integration/test_pr_auto_review_stub.py b/tests/dev-lead/integration/test_pr_auto_review_stub.py index 534afab8c..8427ec9c8 100644 --- a/tests/dev-lead/integration/test_pr_auto_review_stub.py +++ b/tests/dev-lead/integration/test_pr_auto_review_stub.py @@ -10,7 +10,7 @@ reusable's checkout. Dependabot PRs are handled by dependabot-automerge.yml and never need the review-agent dispatch. -Regression guard: dropping the Dependabot guard (or repinning off the @pr-auto-review/v1-next +Regression guard: dropping the Dependabot guard (or repinning off the @pr-auto-review/v1-stable channel) reintroduces the failure class. """ from __future__ import annotations @@ -24,7 +24,7 @@ WORKFLOW = ".github/workflows/pr-auto-review.yml" REUSABLE = "petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml" -EXPECTED_REF = "@pr-auto-review/v1-next" +EXPECTED_REF = "@pr-auto-review/v1-stable" DEPENDABOT_ACTOR = "dependabot[bot]" @@ -69,7 +69,7 @@ def main() -> int: failures.append( f" Wrong ref: {ref!r}\n" f" Expected: '{REUSABLE}{EXPECTED_REF}'\n" - " Reason: first-party reusable must stay on the @pr-auto-review/v1-next\n" + " Reason: first-party reusable must stay on the @pr-auto-review/v1-stable\n" " moving channel (AGENTS.md §Release channel tags)." )