Repository navigation
feat: implement issue #174 — [Fleet Monitor] petry-projects/ContentTwin — dev-lead.yml - #175
Conversation
…in — dev-lead.yml
📝 WalkthroughWalkthroughAdds concurrency control to the dev-lead workflow with conditional grouping for ChangesDev-Lead Workflow Configuration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
There was a problem hiding this comment.
Code Review
This pull request adds a redundant entry for ".dev-lead/" to the ".gitignore" file, which already contains duplicate entries. The reviewer correctly identified this redundancy and suggested cleaning up the file to maintain a unique list of ignored patterns, while also noting a discrepancy between the PR title and the actual changes.
There was a problem hiding this comment.
Pull request overview
This PR addresses issue #174 by adjusting the dev-lead.yml workflow to reduce degraded run behavior, primarily by introducing workflow-level concurrency controls.
Changes:
- Added a
concurrencypolicy to.github/workflows/dev-lead.ymlto serialize most runs while allowing per-SHAcheck_runexecution. - Updated
.gitignore(though it now contains redundant duplicate entries).
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.gitignore |
Adds another .dev-lead/ ignore entry (now duplicated). |
.github/workflows/dev-lead.yml |
Adds workflow-level concurrency grouping to reduce overlapping runs. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1225d09aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| github.event_name == 'check_run' && format('dev-lead-ci-relay-{0}', github.event.check_run.head_sha) || | ||
| 'dev-lead' | ||
| }} | ||
| cancel-in-progress: false |
There was a problem hiding this comment.
Preserve all triggered runs in the concurrency group
This workflow-level concurrency block enables serialization but leaves queue at its default (single), which means only one pending run is kept and each newer trigger cancels the previous pending one. Because this workflow listens to user-driven events (issue_comment, pull_request_review_comment, issues, etc.), bursts of activity while a run is in progress can silently drop earlier events, so commands/comments may never be processed. Add queue: max (or otherwise redesign) if the intent is “one active run per repo” without losing intermediate triggers.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/dev-lead.yml (1)
40-48: Concurrency control likely won’t address the root cause of the high failure rateThe concurrency group only changes queuing/cancellation behavior (and
cancel-in-progress: falsewon’t cancel in-progress runs), so it won’t fix underlying test/workflow failures from flakiness, environment issues, or code bugs. In the latest 300 runs fordev-lead.yml, failures remain substantial (111 failures vs 28 successes) alongside cancellations (50 cancelled), so the failure rate doesn’t look like it’s purely driven by runs being cancelled mid-execution.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/dev-lead.yml around lines 40 - 48, The workflow is relying on the concurrency block (symbols: concurrency, group, cancel-in-progress) to manage failures but that only controls queuing/cancellation and won't fix flaky or broken tests; update the workflow by (1) deciding whether you actually want duplicate runs cancelled (set cancel-in-progress: true) or keep it false for queuing, (2) add proactive fixes: add retry logic for flaky steps (use a retry wrapper action or job-level retries), enable artifact/test log collection and more verbose test output, and (3) add a diagnostic job that runs the failing test matrix repeatedly to surface flakiness and gather metrics so you can root-cause and fix broken tests rather than relying on concurrency to mask failures.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitignore:
- Around line 1-3: Remove the duplicate .dev-lead/ entries in the .gitignore
content by leaving a single .dev-lead/ pattern and deleting the other two
duplicates; ensure only one line containing ".dev-lead/" remains to avoid
redundant entries and potential confusion for future maintainers.
---
Nitpick comments:
In @.github/workflows/dev-lead.yml:
- Around line 40-48: The workflow is relying on the concurrency block (symbols:
concurrency, group, cancel-in-progress) to manage failures but that only
controls queuing/cancellation and won't fix flaky or broken tests; update the
workflow by (1) deciding whether you actually want duplicate runs cancelled (set
cancel-in-progress: true) or keep it false for queuing, (2) add proactive fixes:
add retry logic for flaky steps (use a retry wrapper action or job-level
retries), enable artifact/test log collection and more verbose test output, and
(3) add a diagnostic job that runs the failing test matrix repeatedly to surface
flakiness and gather metrics so you can root-cause and fix broken tests rather
than relying on concurrency to mask failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 76821f19-9352-43e8-ad60-47e7029f46e5
📒 Files selected for processing (2)
.github/workflows/dev-lead.yml.gitignore
…in — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
…in — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
…deation.yml-permissions (#371) * Add Claude Code GitHub Action (#5) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#12) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#8) - Scope workflow token permissions (#9) - Add Dependabot configuration (#10) - Ensure SAST runs on all commits (#11) Closes #8, #9, #10, #11 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use correct CodeQL action commit SHA The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add actions: read to CodeQL workflow permissions - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 3.35.1 to 4.35.1 (#15) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump actions/checkout from 4.2.2 to 6.0.2 (#16) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.2.2...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump anthropics/claude-code-action from 1.0.80 to 1.0.81 (#13) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.81. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...e7b588b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.81 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#30) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input - Add dependabot skip condition on step - Add permission comment for contents: write Matches the standard defined in combsmith/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#31) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#39) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#40) * feat: add workflow to create code-quality repository ruleset Creates the required 'code-quality' branch ruleset with SonarCloud as a required status check on the default branch. This workflow runs on every push to main (idempotent) to ensure the ruleset stays in sync. Closes #28 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * revert: remove workflow approach - cannot push workflow files * chore(workflows): adopt centralized stubs from petry-projects/.github (#52) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See combsmith/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 (#84) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#114) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#114)" This reverts commit d49958d. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 (#122) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump github/codeql-action from 4.35.3 to 4.35.4 (#138) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore: delete stray codeql.yml workflow (#107) * chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * ci: remove drift codeql.yml — GitHub-managed default setup is active (#98) retrigger: bump workflows to run checks Co-authored-by: Claude <claude@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#156) * fix(compliance): enable delete_branch_on_merge repository setting (#102) * fix(compliance): enable delete_branch_on_merge repository setting Apply the `delete_branch_on_merge` repository setting required by org standards (standards/github-settings.md#merge-settings). This is a repository-level setting applied via the GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin \ -f delete_branch_on_merge=true # confirmed: true Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: update code-quality ruleset to full required check list (#100) * fix: update code-quality ruleset to full required check list Add all required status checks to scripts/setup-rulesets.sh: - SonarCloud, Analyze (actions), Lint, Format - agent-shield / AgentShield, dependency-audit / Detect ecosystems Explicitly excludes claude-code / claude (see comment) to avoid deadlocking workflow-modifying PRs. Also enables strict_required_status_checks_policy to match the live ruleset. Closes #81 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix(compliance): enable delete_branch_on_merge repository setting (#95) * fix(compliance): enable delete_branch_on_merge repository setting The repository setting `delete_branch_on_merge` must be enabled per org standards (standards/github-settings.md#repository-settings--standard-defaults). Applied via GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin -f delete_branch_on_merge=true This is a repository-level setting, not a file change. The next weekly compliance audit will verify the fix and auto-close this finding. Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: pin dependabot-automerge reusable workflow to SHA (#90) * fix: pin dependabot-automerge reusable workflow to SHA Pins petry-projects/.github reusable workflow from @v1 to commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (v1) to satisfy the action-pinning policy. Closes #58. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #146 — Compliance: secret_scanning_non_provider_patterns (#170) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #134 — Compliance: check-suite-auto-trigger-347564 (#167) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #147 — Compliance: dependabot_security_updates (#166) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml (#165) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #143 — Compliance: non-stub-dependabot-automerge.yml (#164) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #133 — Compliance: check-suite-auto-trigger-1236702 (#172) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #142 — Compliance: codeowners-org-leads-not-first (#163) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #174 — [Fleet Monitor] petry-projects/ContentTwin — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #131 — Compliance: codeowners-no-catchall (#162) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #144 — Compliance: non-stub-pr-review-mention.yml (#177) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#211) * rollout: deploy pr-review-mention standard workflow * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: correct pr-auto-review reusable workflow reference (#219) * fix: correct pr-auto-review reusable workflow reference * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow (#222) Co-authored-by: Claude Code Bot <noreply@anthropic.com> * feat: implement issue #205 — Compliance: gitignore_secrets_block (#230) * feat: implement issue #205 — Compliance: gitignore_secrets_block * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable (#291) * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github (#293) * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#308) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#327) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#328) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #342 — Compliance: dev-lead-stub-agent-ref (#349) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#366) * chore: insert org secrets baseline in .gitignore * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #346 — Compliance: stub-surface-drift-feature-ideation.yml-permissions * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix: restore secrets-baseline END sentinel and add-to-project trailing newline Reverts two accidental truncation hunks unrelated to issue #346, per the automated review: .gitignore's org-managed secrets-baseline closing sentinel must not be edited, and the add-to-project.yml stub newline removal was pointless drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>



Closes #174
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit