[don-petry]

Closes #967

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• New Features

  • Added a new bootstrap workflow to prepare newly created repositories with standard settings, rules, labels, and ownership checks.
  • Added dry-run support so changes can be previewed without making updates.

• Bug Fixes

  • Improved validation and failure handling to stop the bootstrap process when a step fails.
  • Added checks for missing arguments and required tooling before running.

• Tests

  • Added coverage for bootstrap behavior, dry-run output, step ordering, and ruleset expectations.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ff9bb8c4-f375-46e9-a75c-10d724539f34

📥 Commits

Reviewing files that changed from the base of the PR and between 6fceab6 and 205984b.

📒 Files selected for processing (4)

• .github/rulesets/pr-quality.json
• .github/workflows/lint.yml
• scripts/bootstrap-new-repo.sh
• tests/test_bootstrap_new_repo.bats

---

📝 Walkthrough

Walkthrough

Adds scripts/bootstrap-new-repo.sh, a four-stage orchestrator that invokes apply-repo-settings.sh, apply-rulesets.sh, label creation, and CODEOWNERS verification with dry-run support. Codifies .github/rulesets/pr-quality.json for squash-only PRs with review requirements. Adds a Bats test suite and registers it in the lint workflow.

Bootstrap New Repo

Layer / File(s)	Summary
pr-quality ruleset definition .github/rulesets/pr-quality.json, tests/test_bootstrap_new_repo.bats	Defines the pr-quality ruleset JSON with active enforcement, two bypass actors (OrganizationAdmin + Integration), ~DEFAULT_BRANCH targeting, and pull_request rule requiring 1 approval, code-owner review, thread resolution, stale-review dismissal, and squash merge only. Tests assert all structural fields and reject hardcoded refs/heads/main.
bootstrap-new-repo.sh orchestrator scripts/bootstrap-new-repo.sh	Adds the bootstrap script with DRY_RUN bridging (DEV_LEAD_DRY_RUN / DRY_RUN), BOOTSTRAP_LABELS constant, pass_summary/fail_summary output helpers, four step_* functions (repo settings, rulesets, best-effort labels, best-effort CODEOWNERS verification), main with upfront input/tool/path validation and fail-fast stage sequencing, and a source-guard enabling test imports.
Bats tests and lint registration tests/test_bootstrap_new_repo.bats, .github/workflows/lint.yml	Adds setup/teardown with PATH-isolated stub dir, _stub_gh capturing write calls to a log file, _stub_substeps for configurable sub-script exit codes, DRY_RUN path tests, orchestration ordering and fail-fast tests, success/FAIL summary assertions, and argument-missing coverage; registers the file in the bats lint job.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-967-20260627-1535

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-27T16:48:16Z.

[gemini-code-assist]

Code Review

This pull request introduces a new bootstrap script scripts/bootstrap-new-repo.sh to automate repository compliance, along with a codified pr-quality.json ruleset and a comprehensive test suite in tests/test_bootstrap_new_repo.bats. The review feedback highlights several opportunities to improve script robustness and safety under set -u, such as safely defaulting positional parameters to prevent unbound variable crashes, implementing error handling for mktemp in tests, adding pre-flight checks for CLI dependencies, and optimizing subshell usage with here-strings.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-27T16:55:19Z.

[don-petry]

@donpetry-bot please re-review — the prior review was rate-limited at 15:55 (marker on sha 81b3bda). The addressed fixes are in: all 8 review threads are resolved, every required check is green (CodeQL, SonarCloud, bats, ShellCheck, unit-tests), and squash auto-merge is armed. This PR is ready for the approving review.

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 81b3bda67296fb0ad4a8262ede068585eb057d76
Review mode: triage-approved (single reviewer)

Summary

Phase-2 bootstrap wrapper for issue #967: a thin, DRY_RUN-aware orchestrator (scripts/bootstrap-new-repo.sh) that chains the existing apply-repo-settings.sh and apply-rulesets.sh with fail-fast + pass/fail summary, plus a codified .github/rulesets/pr-quality.json, a 167-line bats suite, and its registration in lint.yml. No policy is reimplemented — the script orchestrates existing apply-* scripts and the new ruleset is data apply-rulesets.sh consumes.

Linked issue analysis

Closes #967. All five acceptance criteria are met: (1) the script invokes apply-repo-settings.sh then apply-rulesets.sh --repo in sequence, fails fast, and prints PASS/FAIL summaries (covered by the sequencing + fail-fast bats tests); (2) pr-quality.json mirrors code-quality.json exactly — OrganizationAdmin + Integration app id 3167543 (dependabot-automerge), both bypass_mode always, targeting ~DEFAULT_BRANCH with no legacy/ad-hoc main ruleset; (3) required status checks remain wired via the existing code-quality.json (SonarCloud, CodeQL, agent-shield, dependency-audit) while pr-quality.json carries the review rule — a clean division of concerns, and the standard label set + CODEOWNERS-team verification are applied; (4) no policy is reimplemented; (5) the bats test covers DRY_RUN and fail-fast paths and is registered in lint.yml. A single DRY_RUN flag is correctly bridged onto DEV_LEAD_DRY_RUN and DRY_RUN for the two sub-scripts.

Findings

No blocking issues. The shell script uses set -euo pipefail, defaults all positionals safely under set -u, passes the repo arg as a plain gh argument (no eval / no injection surface), and treats reads/labels/CODEOWNERS verification as best-effort while failing fast on the two policy-applying steps. All 8 gemini-code-assist review threads (set -u robustness, mktemp error handling, dependency pre-flight checks, here-string usage) are resolved. Advisory bots CodeRabbit and Codex were rate-limited and did not post substantive findings — this re-review is exactly the recovery path for those rate-limited markers; SonarCloud (0 new issues) and CodeQL both passed.

CI status

All required checks green: CodeQL (actions + python), SonarCloud (Quality Gate passed, 0 new issues), bats, ShellCheck/Lint, unit-tests, AgentShield, gitleaks secret scan, holdout-guard, test-deletion guard, validate-agent-profiles. Per-ecosystem dependency-audit jobs SKIPPED as expected. mergeStateStatus is BEHIND (branch needs rebase) but mergeable=MERGEABLE; squash auto-merge is armed.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-27T17:37:41Z.