[don-petry]

Closes #870

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 6 minutes and 6 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses rolling per-developer review limits. Reviews become available again as older review attempts age out of the rolling limit window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e679d15e-9a6e-4d6c-8870-0282ec07fc13

📥 Commits

Reviewing files that changed from the base of the PR and between 89eb3f7 and f078c25.

📒 Files selected for processing (5)

• AGENTS.md
• docs/release/runbook.md
• docs/release/versioning.md
• scripts/cut-release.sh
• tests/test_cut_release.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-870-20260623-1721

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[gemini-code-assist]

Code Review

This pull request documents and integrates six cross-repo reusables (agent-shield, auto-rebase, dependency-audit, dependabot-automerge, dependabot-rebase, and pr-review-mention) under the release ring model. It updates the release script cut-release.sh to recognize these agents and restrict live pushes until the cross-repo target is wired, while expanding the test suite in test_cut_release.bats to cover them. There are no review comments, and I have no feedback to provide.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-23T18:35:47Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0 (Quality Gate passed with 0 new issues)
Files changed: 4 (AGENTS.md, docs/release/runbook.md, docs/release/versioning.md, scripts/cut-release.sh, tests/test_cut_release.bats)
Status: Awaiting in-progress checks (Analyze, bats, review) to complete
```

[don-petry]

@donpetry-bot please review — extends cut-release.sh to cover the .github-hosted reusables (#870 tooling half). All required checks green; the dev-lead/ci-relay+dispatch reds are non-required.

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: f078c2586d70a6f556fb9d7af72020934ca2041b
Review mode: triage-approved (single reviewer)

Summary

Extends scripts/cut-release.sh to recognize the six .github-hosted #482 reusables (agent-shield, auto-rebase, dependency-audit, dependabot-automerge, dependabot-rebase, pr-review-mention) alongside feature-ideation, factoring a new cross_repo_agent helper out of valid_agent. Adds a protective guard that refuses live (non-dry-run) cuts for any cross-repo agent until the cross-repo push target is wired (TODO #872), so tags are never written to the wrong remote. The bulk of the +225/-56 diff is release docs (versioning.md, runbook.md, AGENTS.md link fix) and 107 lines of new bats coverage. Confirms the triage low-risk assessment.

Linked issue analysis

Closes #870. The issue's proposed work item 1 (extend cut-release.sh: valid_agent / release_ref / channel_ref + versioning/runbook docs) is substantively implemented, and item 4 (the explicit org-owner ring assignment table) is documented. Items 2-3 (re-cutting releases and making check_centralized_workflow_stubs ring-aware) are operational steps that depend on the cross-repo push target reserved for a human decision (TODO #872); the PR is transparent about delivering the 'tooling half' only (title + author comments), and the docs explicitly note these agents are deliberately absent from canary-rings.json until #872 lands. Reasonable scoping for an additive, guard-railed tooling change.

Findings

No blocking issues.

• Logic is consistent: valid_agent delegates unknown names to cross_repo_agent; both the --dry-run placeholder warning and the live-cut refusal use cross_repo_agent, so the in-repo (pr-review, dev-lead) vs cross-repo split is enforced uniformly. The unknown-agent error message was updated to list all accepted agents.
• Tests are thorough: per-agent valid_agent/cross_repo_agent acceptance, negative cases (pr-review/dev-lead are NOT cross-repo, unknown rejected), and release_ref/channel_ref formatting variants.
• The six agent names in code exactly match issue #870's list. No auth/secrets/migrations/injection or GitHub Actions security smells. Net effect of the guard is more conservative (refuses live cross-repo cuts).
• Nit (non-blocking): 'Closes #870' will auto-close an issue whose operational half remains; consider 'Part of #870' if the issue should stay open until #872 work completes.

CI status

All required checks green: ShellCheck/shellcheck, bats, unit-tests, CodeQL (actions+python), SonarCloud (quality gate passed, 0 new issues), Secret scan (gitleaks), AgentShield, validate-agent-profiles, holdout-guard, Test-Deletion Guard. The only non-green checks are dev-lead/ci-relay and dev-lead/dispatch (CANCELLED), which are non-required. gemini-code-assist reviewed with no feedback; CodeRabbit/Codex were rate-limited (advisory only). mergeStateStatus is BLOCKED pending the required org-leads human review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.