[don-petry]

Problem

pr-review/stable is still v1.7.0 (ceab48a), but TalkTerm's caller is currently pinned to ded84ce = v1.8.0, which is the unreleased next/dogfood channel:

uses: …/pr-review.yml@ded84ce4820dce379f177f9992beb74483f6d6b4 # pr-review/stable (v1.7.0)

(The comment is doubly stale — it's the v1.8.0 commit, and that commit is next, not stable.)

Root cause

TalkTerm was the only pr-review consumer pinned to a commit SHA. Dependabot's github-actions updater resolves a SHA-pinned reusable to its tag and auto-bumps to the newest tag — so #310 (app/dependabot) bumped pr-review.yml "from 1.7.0 to 1.8.0", pulling TalkTerm onto v1.8.0 ahead of the stable promotion. This bypasses the release-ring/channel strategy (consumers ride stable; only .github-private dogfoods next).

The other consumers (markets, ContentTwin, google-app-scripts, bmad-bgreat-suite, and now broodly) reference the non-semver moving tag @pr-review/stable, which Dependabot cannot version-compare and therefore never bumps — which is why none of them drifted.

Fix

Drop the SHA pin; use the moving tag like the rest of the fleet:

uses: …/pr-review.yml@pr-review/stable

• Returns TalkTerm to stable (v1.7.0) immediately.
• Dependabot-immune going forward — releases roll out centrally by moving the tag, this file never changes on promotion.
• Header comment rewritten to document why not to re-pin to a SHA, so this doesn't regress.

No other changes: triggers, explicit secrets (incl. the classic PAT for approvals), and agent_ref: pr-review/stable are unchanged.

Note

This supersedes the SHA-pin approach from #309 — that pin is exactly what let Dependabot drift the version. Functionally v1.8.0 has been running cleanly on TalkTerm (135 success / 7 failure since the bump), so this is a channel-correctness fix, not an incident response.

Summary by CodeRabbit

• Chores
  • Updated the pull request review workflow to reference the latest stable shared configuration instead of a fixed revision, keeping the same provided inputs and secrets.
  • Extended SonarCloud S7637 issue ignore rules to cover the pr-review.yml file, updating the aggregated ignore criteria list accordingly.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 50 minutes and 30 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2211c8ae-3c82-4433-920d-0fa978eddd1a

📥 Commits

Reviewing files that changed from the base of the PR and between 63ca1a6 and 41e109b.

📒 Files selected for processing (1)

• .github/workflows/pr-review.yml

📝 Walkthrough

Walkthrough

The PR review workflow now uses the pr-review/stable moving tag instead of a commit-SHA pin, and SonarCloud ignore settings were extended for pr-review.yml.

Changes

PR review workflow and Sonar ignore update

Layer / File(s)	Summary
Workflow reference update .github/workflows/pr-review.yml	The workflow comment and review job reference now describe and use pr-review/stable as a moving tag instead of a commit-SHA pin.
SonarCloud ignore criterion sonar-project.properties	The SonarCloud multicriteria list now includes s7637_prreview, which ignores githubactions:S7637 for **/pr-review.yml.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• petry-projects/TalkTerm#277: Also updates .github/workflows/pr-review.yml and the reusable pr-review/stable workflow reference pattern.

Suggested reviewers

• donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: switching pr-review to the moving stable tag to prevent Dependabot drift.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/pr-review-moving-tag-no-sha-drift

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #325
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-27T13:27:37Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-27T13:27:37Z

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Config error

SonarCloud is failing because .github/workflows/pr-review.yml now references the reusable workflow via a mutable moving tag (@pr-review/stable) instead of a pinned commit SHA. SonarCloud enforces a rule against unpinned GitHub Actions references (e.g., rule S6931/S6891) because mutable tags can be silently redirected to a different — potentially malicious — commit, creating a supply-chain security risk. The PR intentionally made this change to avoid Dependabot auto-bumping, but SonarCloud treats it as a security hotspot.

Suggested fix: Add a SonarCloud inline suppression comment on the uses: line — e.g., # NOSONAR or configure the specific rule as "Won't Fix" in the SonarCloud project dashboard for this file/pattern — to acknowledge the intentional trade-off and let the quality gate pass.

View run logs

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[github-actions]

CI Failure: SonarCloud

Step: SonarCloud analysis (githubactions:S7637)
Root cause: Config error

The PR unpins the uses: ref in pr-review.yml from a commit SHA to the moving tag @pr-review/stable, which triggers SonarCloud rule githubactions:S7637 (unpinned third-party Action). A new sonar.issue.ignore.multicriteria exclusion is added for pr-review.yml, but — as the existing comment in sonar-project.properties already notes — that setting suppresses only the quality gate, not the SARIF upload that drives the GitHub Advanced Security "SonarCloud" check. The GHAS integration sees the raw finding and fails the check regardless of the multicriteria exclusion.

Suggested fix: Add a # NOSONAR inline comment on the uses: petry-projects/.github-private/...@pr-review/stable line in pr-review.yml to suppress the S7637 finding at the SARIF level, which is what the failing check consumes.

View run logs

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-27T14:40:45Z

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #325
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-27T23:49:55Z

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 41e109bbf87b835aead7c953f924152f0cbf5817
Review mode: triage-approved (single reviewer)

Summary

Caller-stub channel-correctness fix: pr-review.yml drops the commit-SHA pin (ded84ce / v1.8.0-next) and uses the moving pr-review/stable tag, with the canonical # NOSONAR(githubactions:S7637) first-party exemption marker; sonar-project.properties adds a matching s7637_prreview ignore. Returns TalkTerm to stable v1.7.0 and makes the caller Dependabot-immune, matching the rest of the consumer fleet. +18/-5 across 2 files, no logic/trigger/secret changes.

Linked issue analysis

No linked issue (closingIssuesReferences empty). PR body documents the motivation thoroughly: #310 (Dependabot SHA-bump drift onto unreleased next/v1.8.0) and supersedes the SHA-pin approach from #309. Channel-correctness fix, not incident response.

Findings

• Switching a GitHub Actions uses: ref from a full-SHA pin to a moving tag is normally a supply-chain smell (S7637), but here it is the documented org pattern: the target is a FIRST-PARTY reusable workflow in petry-projects/.github-private, consumers ride the central pr-review/stable moving tag, and the NOSONAR marker is the org-canonical exemption (#549). Aligned with AGENTS.md/CLAUDE.md caller-stub guidance, not a violation.
• sonar-project.properties change is a consistent additive ignore for **/pr-review.yml mirroring the existing first-party exemptions; superseded-but-harmless alongside the inline NOSONAR.
• Secret scan: no credential-bearing content in the diff. The GitHub secret-scanning MCP tool was not callable in this Action context (permission not granted) — noted, not blocking; gitleaks CI check passed.
• Downstream impact: other consumers reference their own independent caller files; this change is local to TalkTerm's stub with no cross-repo break.

CI status

All required checks green: CodeQL (actions+python), SonarCloud (quality gate passed, 0 new issues), gitleaks secret scan, AgentShield, dependency-audit, dev-lead dispatch, review/review. dependabot-automerge and audit sub-jobs SKIPPED as expected. Advisory bots non-blocking: Codex (usage-limited), Gemini (unsupported file types), CodeRabbit (rate-limited). mergeStateStatus BLOCKED only on required human review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-28T02:54:47Z.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (quality gate)
Root cause: Lint/style

The PR switches pr-review.yml from a SHA-pinned uses: ref to the moving tag @pr-review/stable, triggering SonarCloud rule githubactions:S7637 ("GitHub Actions should be pinned to a full commit SHA"). Although the PR adds both an inline # NOSONAR(githubactions:S7637) marker and a new sonar.issue.ignore.multicriteria entry (s7637_prreview) in sonar-project.properties, the quality gate is still failing — most likely because SonarCloud's YAML scanner does not recognise the parenthesised rule-key variant of the suppression comment.

Suggested fix: Change the suppression comment on line 60 of pr-review.yml from # NOSONAR(githubactions:S7637) to the bare form # nosonar (case-insensitive, no rule key), which is the universally-supported inline suppression syntax for SonarCloud YAML analysis.

View run logs