[don-petry]

User description

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• dev-lead.yml
• pr-auto-review.yml
• feature-ideation.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

---

CodeAnt-AI Description

Sync workflow stubs to the org’s v1-stable channels

What Changed

• PR auto-review now runs through the new v1-stable reusable workflow channel and can use a fallback workflow secret if the primary one is not present.
• Dev lead and feature ideation workflows now point to their v1-stable reusable channels, matching the current org-standard rollout path.
• The workflow notes were updated to reflect the new central release model for these shared automations.

Impact

✅ Fewer workflow breakages during shared automation updates
✅ More reliable PR auto-review across repos
✅ Consistent org-wide workflow behavior

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	2fff9d0	Jul 22, 2026 · 11:45	11:46

_{Updated in place by CodeAnt AI · last 5 reviews}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0478d4b4-4ee3-450e-8086-6e5f3af14298

📥 Commits

Reviewing files that changed from the base of the PR and between 259c744 and 2fff9d0.

📒 Files selected for processing (3)

• .github/workflows/dev-lead.yml
• .github/workflows/feature-ideation.yml
• .github/workflows/pr-auto-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260722

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Sync org workflow stubs to v1-stable channels (dev-lead, pr-auto-review, ideation)

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Repoint org-standard workflow stubs from /stable to /v1-stable moving-channel tags.
• Update PR auto-review stub comments to codify moving-channel/compliance expectations.
• Add canonical-first PAT secret fallback for PR auto-review reusable invocation.

Diagram

graph TD
  A["dev-lead.yml stub"] --> D{{".github-private reusables"}}
  B["feature-ideation.yml stub"] --> E{{".github reusables"}}
  C["pr-auto-review.yml stub"] --> F[("Repo secrets")] --> E
  subgraph Legend
    direction LR
    _w["Workflow stub"] ~~~ _ext{{"External repo"}} ~~~ _sec[("Secrets")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin reusables to immutable @vn or commit SHA

• ➕ Fully reproducible builds; avoids surprise behavior changes if a channel tag moves
• ➕ Easier to bisect workflow behavior regressions to a single revision
• ➖ Conflicts with stated org compliance model requiring moving channels for rollout/rollback
• ➖ Requires coordinated fan-out bumps across all repos to roll forward/rollback

2. Use a single repo-level secret name without fallback

• ➕ Simpler stub; less conditional logic in secret expression
• ➖ Harder migration path when standardizing on a canonical PAT secret name across repos
• ➖ Forces immediate secret rename/rotation everywhere rather than gradual adoption

Recommendation: Keep the moving-channel v1-stable pins as implemented to align with the org-wide rollout/rollback and compliance model. The added PAT fallback in pr-auto-review.yml is a pragmatic migration aid; ensure the reusable continues to resolve the secret by the expected key name (GH_PAT_WORKFLOWS) and that both secrets are permitted/rotated appropriately.

Files changed (3) +20 / -17

Other (3) +20 / -17

dev-lead.ymlSwitch dev-lead reusable pin to dev-lead/v1-stable +4/-4

Switch dev-lead reusable pin to dev-lead/v1-stable

• Updates the reusable workflow reference and 'agent_ref' from 'dev-lead/stable' to 'dev-lead/v1-stable'. Aligns comments to the new moving-channel name while keeping the stub behavior unchanged.

.github/workflows/dev-lead.yml

feature-ideation.ymlSwitch feature-ideation reusable pin to feature-ideation/v1-stable +1/-1

Switch feature-ideation reusable pin to feature-ideation/v1-stable

• Repoints the 'uses:' reference from 'feature-ideation/stable' to 'feature-ideation/v1-stable' to follow the org’s moving-channel convention. No functional changes beyond the referenced reusable version stream.

.github/workflows/feature-ideation.yml

pr-auto-review.ymlSwitch PR auto-review to v1-stable and add PAT secret fallback +15/-12

Switch PR auto-review to v1-stable and add PAT secret fallback

• Updates documentation to explicitly require the '@pr-auto-review/v1-stable' moving channel and clarifies what repo-local edits are allowed. Repoints the reusable reference to 'pr-auto-review/v1-stable' and passes 'GH_PAT_WORKFLOWS' using a canonical-first secret fallback ('GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS').

.github/workflows/pr-auto-review.yml

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-22T12:47:43Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: (no fixes needed)
Skipped (informational): N/A — Quality Gate passed, no issues flagged
```

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 124 rules

✅ Skills: 5 invoked

  bmad-testarch-ci

  bmad-testarch-test-review

  bmad-testarch-atdd

  bmad-testarch-framework

  bmad-testarch-automate

1. Secret docs out of sync 🐞 Bug ⚙ Maintainability

Description

.github/workflows/pr-auto-review.yml still documents GH_PAT_WORKFLOWS as the required secret,
but the updated mapping now prefers GH_PAT_DON_PETRY and only falls back to GH_PAT_WORKFLOWS.
This is unlikely to break existing setups, but it can confuse adopters/migrations and complicate
troubleshooting/compliance reviews.

Code

.github/workflows/pr-auto-review.yml[R55-58]

+      # Canonical-first fallback (.github-private#1326). The reusable resolves this
+      # secret BY NAME, so only the VALUE changes — the passed key stays named
+      # GH_PAT_WORKFLOWS.
+      GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}

Relevance

⭐⭐⭐ High

Team previously accepted fixing workflow header/docs to match actual config/refs (e.g., PR #170;
similar doc-alignment in PR #289).

PR-#170
PR-#289

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The header documents only GH_PAT_WORKFLOWS as required, while the updated secrets mapping now
explicitly prefers GH_PAT_DON_PETRY and falls back to GH_PAT_WORKFLOWS, creating a
documentation/config mismatch.

.github/workflows/pr-auto-review.yml[24-24]
.github/workflows/pr-auto-review.yml[53-58]
.github/workflows/initiative-driver.yml[73-86]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`pr-auto-review.yml` now supports a preferred PAT secret (`GH_PAT_DON_PETRY`) with a fallback to `GH_PAT_WORKFLOWS`, but the header comment still states only `GH_PAT_WORKFLOWS` is required.

## Issue Context
The job passes `GH_PAT_WORKFLOWS` to the reusable, but its value is now selected via an expression (`GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS`). This means the operational requirement is “one of these PAT secrets must be present”, with precedence.

## Fix Focus Areas
- .github/workflows/pr-auto-review.yml[24-24]
- .github/workflows/pr-auto-review.yml[53-58]

## Suggested change
Update the header line to something like: `Requires: GH_PAT_DON_PETRY (preferred) or GH_PAT_WORKFLOWS (fallback)` (or equivalent wording that matches your org standard).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[don-petry]

Superseding: this PR was generated from the pre-#876 dev-lead template that lacked the # NOSONAR(githubactions:S7635) marker on secrets: inherit. #876 restored the marker in the template; after the driver is made marker-aware (tracked in the new follow-up), a re-sweep will re-open this with correct pins AND the S7635 marker (maximum quality). Closing to avoid deploying a marker-less stub.