[don-petry]

Closes #963

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 32 minutes and 37 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ce66fd29-fb0b-4f78-ad1c-8ddce8b088a7

📥 Commits

Reviewing files that changed from the base of the PR and between f3b24ed and 25a1af1.

📒 Files selected for processing (2)

• .github/workflows/feature-ideation.yml
• tests/test_feature_ideation.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-963-20260627-1524

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-27T16:34:58Z.

[don-petry]

@donpetry-bot review

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[gemini-code-assist]

Code Review

This pull request introduces new BATS tests to validate the discussion-to-dispatch redispatch bridge in the feature-ideation.yml workflow. The review feedback recommends improving the robustness of these tests by replacing rigid string and fixed-expression grep checks with more flexible regular expressions that can handle variations in quotes and spacing.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: e9da1fa2deed2c75155086d458d06a6a73c1d273
Review mode: triage-approved (single reviewer)

Summary

Refactors feature-ideation.yml discussion handling: a new minimal-permission redispatch job re-invokes the workflow via workflow_dispatch (carrying the Idea's discussion number) so single-idea enhancement runs under an event claude-code-action supports, while ideate now runs only on non-discussion events. Mirrors the established initiative-planner.yml #618 bridge. Adds 7 bats tests.

Linked issue analysis

Closes #963 (single-idea enhancement crashes on discussion event contexts, #591-class). The redispatch bridge directly resolves the root cause — the reusable is never invoked inline on a discussion event, where the action aborts with "Unsupported event type: discussion". Behavior preserved: schedule/manual dispatch → empty target_discussion → normal scan; real human Idea in the Ideas category → single-idea enhancement under workflow_dispatch. Substantively addressed.

Findings

No blocking issues.

Security (GitHub Actions): clean. The redispatch job runs with permissions: {}; untrusted-ish values (discussion.number, github.repository) are passed through env vars rather than interpolated into the run script, so there is no ${{ }} script-injection vector. GH_PAT_WORKFLOWS presence is guarded before use. Loop prevention is sound (bot-created discussions filtered; enhancement posts a comment, which does not re-fire discussion: created).

Correctness: trigger logic is consistent — ideate gated on github.event_name != 'discussion'; target_discussion sourced from inputs.target_discussion || '' (empty on schedule/manual → scan mode). 7 new bats tests cover the dispatch input, the redispatch job/guard, the PAT requirement, the forwarded arg, and the ideate gating; bats CI check passed.

Non-blocking (LOW): gemini-code-assist suggested replacing fixed-string/rigid greps in the new bats tests with more flexible regexes (tolerate quote/spacing variation). Reasonable hardening, but the tests match this same-repo workflow file the author controls, so they are not fragile in practice. Codex and CodeRabbit advisory bots were rate-limited (no findings); SonarCloud Quality Gate passed (0 new issues).

CI status

Green. Required checks succeeded (CI Lint/ShellCheck/Secret-scan, CodeQL actions+python, bats, unit-tests, SonarCloud, AgentShield, holdout-guard, test-deletion guard). CANCELLED entries are superseded Dev-Lead Agent re-runs, not failures; the one PENDING check is this review job itself. mergeStateStatus is BLOCKED only on REVIEW_REQUIRED; mergeable=MERGEABLE.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #971
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-27T16:10:13Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-27T16:10:13Z

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-27T16:40:51Z.

[don-petry]

@donpetry-bot review

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 25a1af1c3b87bed4570204ce8f8db12e98811c4c
Review mode: triage-approved (single reviewer)

Summary

Adds the discussion→workflow_dispatch redispatch bridge to the active stub .github/workflows/feature-ideation.yml, fixing #963 (claude-code-action aborts with "Unsupported event type: discussion", so single-idea enhancement never ran on a new Idea). The new redispatch job runs only on discussion events, keeps the ideas-category / non-bot guard, requires GH_PAT_WORKFLOWS (a dispatch fired with GITHUB_TOKEN never starts a run), and re-invokes the workflow forwarding the discussion number as target_discussion. The ideate reusable call now runs only off the discussion event (github.event_name != 'discussion') and sources inputs.target_discussion || ''. Mirrors the established initiative-planner #618 bridge. +114/-12 across the workflow stub and its bats coverage only.

Linked issue analysis

Closes #963. All three implementation requirements are met: (1) target_discussion string input (default '') added to workflow_dispatch; (2) redispatch job gated to discussion events with the category.slug == 'ideas' && user.type != 'Bot' guard, a PAT-presence guard, and gh workflow run feature-ideation.yml -f target_discussion=...; (3) ideate runs only off the discussion event and reads inputs.target_discussion. Acceptance criterion 3 (bats coverage) is satisfied by 7 new tests asserting the job exists, is guarded, requires the PAT, and forwards the input. Criteria 1/2/4 are runtime/end-to-end behaviors validated by #875, consistent with the implemented structure.

Findings

No blocking issues. Security hygiene is sound for an Actions change: the redispatch job sets permissions: {} (least privilege); the untrusted-ish github.event.discussion.number is passed via an env var (DISCUSSION_NUMBER) rather than interpolated into a run: script, avoiding expression injection, and is quoted at the use site; the PAT is referenced through secrets.GH_PAT_WORKFLOWS and guarded for presence. The reusable pin to @feature-ideation/next is pre-existing and intentionally documented, not introduced here. Secret-scanning MCP tool unavailable in this environment; the gitleaks CI check passed and covers the diff. Implementation faithfully mirrors the in-repo initiative-planner #618 precedent.

CI status

All substantive checks green: shellcheck, ShellCheck, Lint, bats, unit-tests, CodeQL, Analyze (actions/python), SonarCloud, Secret scan (gitleaks), AgentShield, Agent Security Scan, validate-agent-profiles, gh-aw-compile, holdout-guard, guard. The duplicate review / review entries marked CANCELLED are superseded earlier-commit runs (a later review / review is SUCCESS); SKIPPED dependency-audit ecosystems are conditional no-ops. mergeStateStatus is BLOCKED pending this required review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.