[don-petry]

Closes #395

Implemented by dev-lead agent. Please review.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 54 minutes and 47 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: b6b95837-6416-4152-aedb-41c60a48f7e8

📥 Commits

Reviewing files that changed from the base of the PR and between 790e68b and ac0027b.

📒 Files selected for processing (7)

• .github/workflows/dev-lead-reusable.yml
• .github/workflows/dev-lead.yml
• .github/workflows/test-dev-lead.yml
• AGENTS.md
• tests/dev-lead/integration/test_concurrency_config.sh
• tests/dev-lead/integration/test_dev_lead_stub.sh
• tests/dev-lead/unit/test_concurrency_config.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-395-20260608-0054

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request updates the documentation and tests to reflect that dev-lead.yml has been converted into a thin caller stub delegating to dev-lead-reusable.yml. It updates AGENTS.md, adjusts concurrency tests, and introduces a new integration test (test_dev_lead_stub.sh) to validate the stub's structure. Feedback on the new test script suggests making the regex check for permissions: {} more robust by allowing spaces inside the curly braces.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e07f63f427

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[don-petry]

Dev-Lead — rate-limited (intent: review-changes)

PR: #488
The retry cron will re-attempt automatically.

[don-petry]

Note

I received your request but all AI engines are currently rate-limited. I'll retry automatically once the rate limit clears.
Rate limit resets at: unknown

[don-petry]

Dev-Lead — rate-limited (intent: fix-bot-comment)

PR: #488
Please re-trigger manually (re-mention @dev-lead) when the rate limit clears — the original request cannot be reconstructed automatically.

[don-petry]

Note

@don-petry I received your request but all AI engines are currently rate-limited. Please re-mention @dev-lead when the rate limit clears (estimated: unknown) — I cannot reconstruct the original instruction automatically.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- "You have reached your Codex usage limits" — usage limit notification only, no code findings,
  no open review threads to reply to or resolve
- dev-lead/dispatch + dev-lead/ci-relay cancelled: concurrency-cancelled run on a bot-authored
  commit ([skip ci-relay] convention); expected behavior, not a code-level defect — no fix possible
Files changed: none
Skipped (informational): 1 (usage limit notification)
```

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 1 — Quality Gate passed (0 new issues, 0 security hotspots,
  0.0% duplication); no actionable findings in the bot comment or in the PR diff
  (no curl|bash, hardcoded credentials, eval-with-user-input, or HTTP download
  patterns detected in changed files)
```

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: ac0027b1be8591829a3e812f42e25c389727f9dd
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

PR #488 correctly converts dev-lead.yml from a 350-line inline workflow to a thin caller stub delegating to dev-lead-reusable.yml@main, resolving the #395 compliance finding. All three P1 advisory findings (concurrency group reuse, .dev-lead/ git staging, comment body propagation) and all P2 findings are addressed in the diff; CI is fully green including CodeQL, SonarCloud, gitleaks, and the new stub-structure validation job.

Findings

• INFO: fix-bot-comment step in dev-lead-reusable.yml adds COMMENT_BODY but does not add ACTOR (the old inline workflow passed both). The ACTOR env var is used by dev-lead-fix-reviews.sh to resolve threads from the triggering reviewer — omitting it may leave some bot-comment-triggered threads unresolved. Not a blocking issue since the advisory only flagged review-changes for this gap, and the script degrades gracefully.
• INFO: DEEP_TIMEOUT_SEC and ACTION_TIMEOUT_SEC are added with '|| ""' fallback instead of the old inline's '|| "600"'. Empty string is functionally equivalent if engine.sh has its own internal default (600s), but if it does not, previously-configured timeout repos may silently revert to a shorter default. Low risk — pre-existing engine.sh behavior is unchanged.
• INFO: Fork guard covers pull_request events but not pull_request_review from fork collaborators. This is an acceptable gap: the reusable's dev-lead-intent.sh will classify such events as 'skip' once secrets are available via the org-level token on review events, and the guard comment in the stub correctly documents the rationale.
• INFO: P1 'Avoid reusing the called workflow concurrency group' is resolved: caller stub carries no concurrency block (verified by test_concurrency_config.sh guard added in this PR), so only dev-lead-reusable.yml's concurrency group applies.
• INFO: P1 'Avoid committing the reusable checkout' is resolved: the two-step approach (temp append to .gitignore → git checkout .gitignore || true + append to .git/info/exclude) correctly prevents .dev-lead/ from ever being staged by handler scripts that call git add -A.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.