fix(pr-review): use moving @pr-review/stable tag (stop Dependabot version drift)

.github/workflows/pr-review.yml

@@ -4,9 +4,19 @@ name: PR Review Agent
 # pinned to the known-good `pr-review/stable` channel. Adopted from the validated
 # `.github-private/pr-review-trigger.yml` template (#536 consumer fan-out).
 #
-# - Version selection is the `pr-review/stable` tag. The `uses:` line is pinned
-#   to the tag's current commit SHA and must be bumped when the tag is promoted.
-#   `agent_ref` tracks the mutable tag so agent scripts use the promoted version.
+# - Version selection is the MOVING `pr-review/stable` tag — this file never
+#   changes on promotion; a release is rolled out by moving the tag centrally.
+#   Do NOT pin the `uses:` ref to a commit SHA here: Dependabot's github-actions
+#   updater treats a SHA-pinned reusable as a versioned dependency and auto-bumps
+#   it to the newest tag, which dragged this caller onto the unreleased `next`
+#   v1.8.0 ahead of stable (#310). A non-semver moving tag is left untouched by
+#   Dependabot, matching the other consumers (markets/ContentTwin/...).
+# - The channel-pinned `uses:` line carries the inline
+#   `# NOSONAR(githubactions:S7637)` marker — the org-wide canonical exemption
+#   for first-party reusable-ref caller stubs (#549). It suppresses SonarCloud's
+#   "pin actions to a full SHA" rule at analysis time, clearing BOTH the quality
+#   gate AND the code-scanning SARIF alert (supersedes the per-file
+#   `sonar-project.properties` exemption, which only quieted the gate).
 # - `agent_ref: pr-review/stable` pins the agent's own scripts to the same
 #   channel (#506), so the review logic AND scripts run the known-good version.
 # - Secrets are passed explicitly to the reusable workflow.
@@ -47,7 +57,7 @@ jobs:
       contents: read
       pull-requests: write
       checks: read
-    uses: petry-projects/.github-private/.github/workflows/pr-review.yml@ded84ce4820dce379f177f9992beb74483f6d6b4 # pr-review/stable (v1.7.0)
+    uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable  # NOSONAR(githubactions:S7637) first-party channel ref
     with:
       agent_ref: pr-review/stable
       pr_url: ${{ inputs.pr_url || '' }}

sonar-project.properties

@@ -13,11 +13,14 @@ sonar.exclusions=_bmad/**,_bmad-output/**,.claude/**,docs/**
 # quiets the quality gate, not the code-scanning SARIF, so the
 # GitHub-Advanced-Security "SonarCloud" check still failed on new alerts (e.g.
 # the dev-lead repin). Third-party `uses:` keep full SHA-pin enforcement.
-sonar.issue.ignore.multicriteria=s7637_agentshield,s7637_prreviewmention,s7637_autorebase,s7637_dependabotrebase,s7637_dependabotautomerge,s7637_dependencyaudit,s7637_devlead
+sonar.issue.ignore.multicriteria=s7637_agentshield,s7637_prreview,s7637_prreviewmention,s7637_autorebase,s7637_dependabotrebase,s7637_dependabotautomerge,s7637_dependencyaudit,s7637_devlead
 
 sonar.issue.ignore.multicriteria.s7637_agentshield.ruleKey=githubactions:S7637
 sonar.issue.ignore.multicriteria.s7637_agentshield.resourceKey=**/agent-shield.yml
 
+sonar.issue.ignore.multicriteria.s7637_prreview.ruleKey=githubactions:S7637
+sonar.issue.ignore.multicriteria.s7637_prreview.resourceKey=**/pr-review.yml
+
 sonar.issue.ignore.multicriteria.s7637_prreviewmention.ruleKey=githubactions:S7637
 sonar.issue.ignore.multicriteria.s7637_prreviewmention.resourceKey=**/pr-review-mention.yml