chore: sync 4 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• dev-lead.yml
• agent-shield.yml
• add-to-project.yml
• pr-auto-review.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

Problem

See the linked issue.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

No test files were added or updated. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #2052
No changes were committed, but the PR still can't be marked done: required check SonarCloud is still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-10-03T23:24:02Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required check SonarCloud is still pending. I'll re-check automatically.
Next attempt after: 2026-10-03T23:24:02Z

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-10-03T23:55:43Z.

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[donpetry-bot]

Superseded by automated re-review at 65471bce3fa86b98bda01d09e05e84f339d3a22c — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 5572bb3740e0adbe2b81ed26c560353750e87ad8
Cascade: triage → deep+duck (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7])

Summary

Both reviewers rate the PR MEDIUM risk and escalate, so they agree fully. Both engines flagged the failing sync-scope-guard check (no path manifest), the removed Dependabot guard in pr-auto-review.yml, the stable-to-next channel moves (dev-lead, agent-shield, add-to-project) and the contradictory pr-auto-review header. The deep reviewer reproduced three failing stub tests locally. The rubber duck alone raised the secrets: inherit exposure of dev-lead on an unpromoted channel and a cancel-in-progress starvation concern.

Cross-engine agreement

full

Findings

• major: {"severity":"major","category":"ci","message":"sync-scope-guard fails: PR is a sync PR but declares no path manifest. Regenerate it so the manifest is present. Several dev-lead / dispatch runs are also CANCELLED.","file":null,"line":null,"sources":["deep","rubber-duck"]}
• major: {"severity":"major","category":"regression","message":"The job-level Dependabot guard was removed from pr-auto-review.yml. Dependabot runs reach the reusable without GH_PAT_WORKFLOWS and the checkout fails with 'Input required and not supplied: token' (reintroduces [Fleet Monitor] petry-projects/.github-private — .github/workflows/pr-auto-review.yml #1390 / bug(dev-lead): caller stub fires on Dependabot PRs and fails at startup (secrets unavailable) #864). test_pr_auto_review_stub.py fails with 'Missing Dependabot guard'.","file":".github/workflows/pr-auto-review.yml","line":70,"sources":["deep"]}
• major: {"severity":"major","category":"regression","message":"The Dependabot skip guard ([Fleet Monitor] petry-projects/.github-private — .github/workflows/pr-auto-review.yml #1390) is removed. Dependabot pull_request runs have no access to GH_PAT_WORKFLOWS, so the reusable's checkout fails and false failures return on every Dependabot PR.","file":".github/workflows/pr-auto-review.yml","line":62,"sources":["rubber-duck"]}
• major: {"severity":"major","category":"channel-pin","message":"The required AgentShield scanner caller moves from @agent-shield/v2-stable to the unpromoted @agent-shield/v2-next. test_agent_shield_stub.py fails. The security gate could break or be weakened.","file":".github/workflows/agent-shield.yml","line":34,"sources":["deep"]}
• major: {"severity":"major","category":"channel-pin","message":"The dev-lead self-host stub's uses: and agent_ref move from v139-stable to v139-next. The in-development dev-lead then controls this repo's own PRs. caller_stub_freeze.sh reports DRIFTED and the baseline is not regenerated.","file":".github/workflows/dev-lead.yml","line":70,"sources":["deep"]}
• major: {"severity":"major","category":"supply-chain-stability","message":"Pins move from -stable to -next (dev-lead, agent-shield, add-to-project). dev-lead runs with 'secrets: inherit' and contents: write, so in-development reusable code gets full org secrets. The PR body does not say this is intentional.","file":".github/workflows/dev-lead.yml","line":70,"sources":["rubber-duck"]}
• minor: {"severity":"minor","category":"channel-pin","message":"add-to-project's uses: and agent_ref move from v1-stable to the unpromoted v1-next. The PR description doesn't explain why.","file":".github/workflows/add-to-project.yml","line":50,"sources":["deep"]}
• minor: {"severity":"minor","category":"consistency","message":"The header says 'You MUST NOT change: the @pr-auto-review/v1-stable channel' but the uses: line still pins @pr-auto-review/v1-next. The stub contradicts itself and the sync direction looks inverted.","file":".github/workflows/pr-auto-review.yml","line":11,"sources":["deep"]}
• minor: {"severity":"minor","category":"logic","message":"The concurrency group expression '(cond && number) && format(...) || ...' is fragile, though it works because PR numbers are never 0. The header comment says MUST NOT change v1-next but the diff rewrites it to v1-stable while uses: is untouched, so the compliance audit may be wrong about the expected channel.","file":".github/workflows/pr-auto-review.yml","line":11,"sources":["rubber-duck"]}
• minor: {"severity":"minor","category":"concurrency","message":"cancel-in-progress on check_suite and workflow_run triggers can cancel a ready-check run that was about to dispatch a review. A burst of events could starve dispatch if the last event is a no-op.","file":".github/workflows/pr-auto-review.yml","line":62,"sources":["rubber-duck"]}
• info: {"severity":"info","category":"logic","message":"The new concurrency block groups check_suite and workflow_run events by PR with cancel-in-progress. No grouping bug found, but it is a behavior change on top of a 'verbatim stub sync' and belongs in its own reviewed PR.","file":".github/workflows/pr-auto-review.yml","line":59,"sources":["deep"]}

---

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[donpetry-bot]

Automated review — escalated to human

The automated review cascade escalated this PR to a human reviewer at review cycle 3/3 (risk: MEDIUM, reviewed commit 8d5dd04706f45d2b26318b3c72fed4e5ea36c64b).

Why: the cascade could neither approve the PR nor auto-request fixes, so it requested human review via CODEOWNERS and set the needs-human-review label. A human should review the PR, or remove the needs-human-review label to re-engage the automated cascade.

Reviewer summary: Both reviewers rate risk MEDIUM but disagree on the decision: deep approves, while the rubber duck escalates over the cancel-in-progress concurrency risk and the PR body not matching the diff. Both agree the cubic P1 about Dependabot is stale, since the job-level guard is intact, and both agree the concurrency expression precedence is correct. Both also flag that cancel-in-progress on check_suite/workflow_run can cancel a run for the same PR, and that the PR description is stale (it claims 4 stubs, the diff changes 1). The rubber duck alone asks for the block to be confirmed against the upstream stub, and the deep reviewer alone notes the local stub drifts from upstream (the Dependabot guard is missing there).

This note is updated in place on re-escalation; it is not re-posted.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed. Requested items addressed:

• .github/workflows/add-to-project.yml:50 — applied
• .github/workflows/agent-shield.yml:34 — applied
• .github/workflows/dev-lead.yml:70 — applied
• .github/workflows/add-to-project.yml:54 — applied
• .github/workflows/agent-shield.yml:34 — applied
• .github/workflows/dev-lead.yml:72 — applied

[don-petry]

Resolved — the `needs-human-review` hold was lifted; dev-lead has picked this item up. Click to expand the prior hold notice.

dev-lead is withholding action on this item.

It is labeled needs-human-review (flagged for human review — this label is applied by automation as well as by people, so an item can become held without anyone noticing), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.

To re-enable automated pickup: remove the needs-human-review label.

[donpetry-bot]

Superseded by automated re-review at fa6628a95c49eecba5caec58886bf4c399b5c603 — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 65471bce3fa86b98bda01d09e05e84f339d3a22c
Cascade: triage → audit (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7])

Summary

I found no new security exposure. The reusable checks out only petry-projects/.github at job_workflow_sha, never PR head code, and the new concurrency expression is not run in a shell and only interpolates numeric PR numbers and run_id. The PR still fails three gates (bats, pr-auto-review-stub, sync-scope-guard). Those failures confirm two problems: the Dependabot guard from #1390/#864 was removed, and the header comment (v1-stable) no longer matches the uses: pin (v1-next). It also only partly applies the upstream stub: 1 of the 4 files the body lists, and the guard deletion is outside what a thin-caller edit may change.

Findings

• major: {"severity":"major","category":"regression","message":"The job-level Dependabot guard was removed. Dependabot-actor runs (pull_request, workflow_run) cannot read GH_PAT_DON_PETRY/GH_PAT_WORKFLOWS. The reusable's checkout of petry-projects/.github (token: secrets.GH_PAT_WORKFLOWS) then fails with 'Input required and not supplied: token', which brings back the [Fleet Monitor] petry-projects/.github-private — .github/workflows/pr-auto-review.yml #1390 false failure. CI check pr-auto-review-stub fails on 'Missing Dependabot guard'. This is a fail-closed problem, not a secret leak. Restore the guard, or get it added to the upstream standard stub first.","file":".github/workflows/pr-auto-review.yml","line":70,"line_note":"job definition"}
• major: {"severity":"major","category":"doc-code-mismatch","message":"The header comment now says 'MUST NOT change the @pr-auto-review/v1-stable channel', but uses: still pins @pr-auto-review/v1-next. The bats channel-pin-consistency test fails. The sync took the upstream header but kept this repo's v1-next pin (standards-sync rewrites the per-repo channel pin it is told to preserve — PR #1819 would move dev-lead from stable to next in the repo that hosts it #1866). Revert the comment to v1-next. Do not repin uses:.","file":".github/workflows/pr-auto-review.yml","line":11}
• minor: {"severity":"minor","category":"ci/process","message":"sync-scope-guard fails because the sync PR has no path manifest. The body says 4 stubs were synced 'verbatim' (dev-lead.yml, agent-shield.yml, add-to-project.yml, pr-auto-review.yml), but the diff touches only pr-auto-review.yml, and that file is not verbatim (uses: differs from upstream).","file":null,"line":null}
• minor: {"severity":"minor","category":"description-quality","message":"The PR description is missing all 5 required sections: problem, risk, test-plan, rollback, monitoring.","file":null,"line":null}
• info: {"severity":"info","category":"gha-security","message":"Security check passed. The concurrency group/cancel-in-progress expressions are evaluated by the Actions runtime, not a shell, and only interpolate integer PR numbers and run_id, so there is no injection risk. Permissions are unchanged (top-level {}, job-level read-only). No new triggers. Secret passing is unchanged. The reusable checks out only first-party code at job_workflow_sha, so even without the guard, Dependabot or fork PR code is never executed with the PAT.","file":".github/workflows/pr-auto-review.yml","line":59}

---

Reviewed by the PR-review cascade (triage: haiku 4.5 [sonnet 5.5, sonnet 5] → deep: opus 5.5 [opus 4.8, sonnet 5.5] + duck: gemini-3.8-flash [sonnet 5.5] → audit: opus 5.5 [opus 4.8, opus 4.7]). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

No description provided.

[don-petry]

No description provided.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

No description provided.

[donpetry-bot]

No description provided.

[don-petry]

No description provided.

[don-petry]

Re-read the CodeRabbit comment after its latest edit (2026-10-10T23:39:12Z, commit 7be1382). It contains only the rate-limit block ("Review limit reached"), run configuration, and autopilot/tips footer. There is no Security Architecture Review section, no actionable-comments section, and no outside-diff or nitpick findings. This is an operational notice only—no code changes needed.

[don-petry]

Re-read the CodeAnt summary after its latest edit (2026-10-10T22:55:29Z, assessed commit 7be1382). It reports Low Risk with no security findings, no action items, and no actionable suggestions. This is a clean-status summary—nothing to fix.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Done. I've posted fresh disposition replies for both stale bot comments:
**Summary:**
| Comment | Bot | Issue | Disposition | Reason |
|---------|-----|-------|-------------|--------|
| IC_kwDOR9SdIs8AAAABZBk-lg | CodeRabbit | Stale disposition (edited 2026-10-10T23:39:12Z, prior disposition from 12:12:19Z) | `informational` | Rate-limit notice only; no architecture-review, actionable-comments, or finding sections present |
| IC_kwDOR9SdIs8AAAABZwtFKw | CodeAnt | Stale disposition (edited 2026-10-10T22:55:29Z, prior disposition from 12:12:20Z) | `informational` | Clean-status summary ("Low Risk"); no findings or action items |
Both disposition replies posted with timestamps after their respective comment edits, so the harness can verify them as current. No code changes were needed since both comments are operational notices without actionable defects.

[donpetry-bot]

Automated review — human attention needed

This PR has been through 3 automated review cycles since the last approval or escalation (cap: 3) without converging. Further automated review has been paused to avoid infinite loops.

Please take a look manually, or close this PR if it's no longer needed. To re-engage the automated cascade with a fresh cycle budget, a human should remove the needs-human-review label after reviewing. Re-engagement is intentionally human-gated (#926): mentioning the bot will not reset the cap.

Posted by the donpetry-bot PR-review cascade.

[don-petry]

dev-lead is withholding action on this item.

It is labeled needs-human-review (flagged for human review — this label is applied by automation as well as by people, so an item can become held without anyone noticing), so dev-lead will not pick it up while that label is present. This notice is posted once so the withhold is visible rather than looking like a stalled run.

To re-enable automated pickup: remove the needs-human-review label.