From 6b7c72a8b77e9994626e2d8aa861664df6698bd3 Mon Sep 17 00:00:00 2001
From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Date: Tue, 21 Jul 2026 19:23:35 +0000
Subject: [PATCH 1/2] =?UTF-8?q?feat:=20implement=20issue=20#385=20?=
 =?UTF-8?q?=E2=80=94=20Migrate=20pr-review.yml=20caller=20to=20`secrets:?=
 =?UTF-8?q?=20inherit`=20(last=20by-name=20pr-review=20caller)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/pr-review.yml | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 769f7716..8076ab22 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -19,9 +19,11 @@ name: PR Review Agent
 #   `sonar-project.properties` exemption, which only quieted the gate).
 # - `agent_ref: pr-review/stable` pins the agent's own scripts to the same
 #   channel (#506), so the review logic AND scripts run the known-good version.
-# - Secrets are passed explicitly to the reusable workflow.
-#   `DON_PETRY_BOT_GH_PAT_CLASSIC` is a classic PAT — required for approvals since
-#   fine-grained PATs cannot `addPullRequestReview`.
+# - Secrets are forwarded via `secrets: inherit`, matching every other pr-review
+#   caller in the org and TalkTerm's own `dev-lead.yml` (#385). The reusable reads
+#   the inherited org secrets it needs (e.g. `DON_PETRY_BOT_GH_PAT_CLASSIC`, a
+#   classic PAT required for approvals since fine-grained PATs cannot
+#   `addPullRequestReview`).
 
 on:
   check_suite:
@@ -82,10 +84,4 @@ jobs:
       pr_url: ${{ inputs.pr_url || '' }}
       dry_run: ${{ inputs.dry_run || '' }}
       force_review: ${{ inputs.force_review || '' }}
-    secrets:
-      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-      GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-      DON_PETRY_BOT_GH_PAT: ${{ secrets.DON_PETRY_BOT_GH_PAT }}
-      DON_PETRY_BOT_GH_PAT_CLASSIC: ${{ secrets.DON_PETRY_BOT_GH_PAT_CLASSIC }}
-      GH_PAT: ${{ secrets.GH_PAT }}
+    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable

From 533b63c3f203026fdf7f29c369bcec8ab5f71cf3 Mon Sep 17 00:00:00 2001
From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Date: Sun, 2 Aug 2026 00:35:52 +0000
Subject: [PATCH 2/2] fix(reviews): address review comments [skip ci-relay]

---
 .github/workflows/pr-review.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 8076ab22..666b0b05 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -21,9 +21,9 @@ name: PR Review Agent
 #   channel (#506), so the review logic AND scripts run the known-good version.
 # - Secrets are forwarded via `secrets: inherit`, matching every other pr-review
 #   caller in the org and TalkTerm's own `dev-lead.yml` (#385). The reusable reads
-#   the inherited org secrets it needs (e.g. `DON_PETRY_BOT_GH_PAT_CLASSIC`, a
-#   classic PAT required for approvals since fine-grained PATs cannot
-#   `addPullRequestReview`).
+#   the inherited org secrets it needs (`DON_PETRY_BOT_GH_PAT_CLASSIC`, falling
+#   back to `DON_PETRY_BOT_GH_PAT`) — a classic PAT required for approvals since
+#   fine-grained PATs cannot `addPullRequestReview`.
 
 on:
   check_suite: