From b38876f40b0dc8987217bb81a7f7d02b7c8761fb Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:45:10 +0000 Subject: [PATCH 1/3] chore: sync 3 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/dev-lead.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index 0f231b66..ec2c71f6 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -56,14 +56,14 @@ permissions: {} jobs: dev-lead: - # Pinned to the moving dev-lead/stable channel tag, not @main, so a broken + # Pinned to the moving dev-lead/v1-stable channel tag, not @main, so a broken # change to dev-lead can no longer gate its own fix (the self-host circular - # dependency). Promotion is done by moving the dev-lead/stable tag centrally; this + # dependency). Promotion is done by moving the dev-lead/v1-stable tag centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#dev-lead-agent. - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref with: - agent_ref: dev-lead/stable + agent_ref: dev-lead/v1-stable secrets: inherit permissions: contents: write From b8163e4ac9c1a737367a6c558be09965edf148a5 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:45:11 +0000 Subject: [PATCH 2/3] chore: sync 3 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/pr-auto-review.yml | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index 301fa63b..4bc47dda 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -6,17 +6,17 @@ # AGENTS — READ BEFORE EDITING: # • This file is a THIN CALLER STUB. All readiness-gate logic lives in the # reusable workflow above. -# • You MAY change: the tag in the `uses:` line when upgrading the reusable -# workflow version (e.g. bump `@v2` → `@v3` when petry-projects/.github cuts -# a new release), and the workflow name(s) in `workflow_run.workflows` to -# match your repository's CI workflow name(s). -# • You MUST NOT change: trigger event types or the job-level `permissions:` -# block — reusable workflows can be granted no more permissions than the -# calling job, so removing the stanza breaks the reusable's gh API calls. +# • You MAY change: the workflow name(s) in `workflow_run.workflows` to match +# your repository's CI workflow name(s). +# • You MUST NOT change: the `@pr-auto-review/v1-stable` channel in the `uses:` +# line — this reusable is on the org-wide moving-channel model (rollout and +# rollback are a single central tag move; a frozen `@vN`/`@` pin is +# rejected by the compliance audit). Nor the trigger event types or the +# job-level `permissions:` block — reusable workflows can be granted no more +# permissions than the calling job, so removing the stanza breaks the +# reusable's gh API calls. # • If you need different behaviour, open a PR against the reusable in the -# central repo. -# • When publishing a new version of this reusable, also update this template -# and open a fanout PR across all caller repos. +# central repo. The change will propagate everywhere on next run. # ───────────────────────────────────────────────────────────────────────────── # # PR Auto-Review — thin caller for the org-level reusable. @@ -50,6 +50,9 @@ jobs: pull-requests: read checks: read actions: read - uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: - GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }} + # Canonical-first fallback (.github-private#1326). The reusable resolves this + # secret BY NAME, so only the VALUE changes — the passed key stays named + # GH_PAT_WORKFLOWS. + GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }} From 2fff9d0abf4072d4aa8a7a1544b56fd47e889ecd Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Wed, 22 Jul 2026 11:45:12 +0000 Subject: [PATCH 3/3] chore: sync 3 org-standard workflow stub(s) from petry-projects/.github --- .github/workflows/feature-ideation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/feature-ideation.yml b/.github/workflows/feature-ideation.yml index 86da6eca..c76321ae 100644 --- a/.github/workflows/feature-ideation.yml +++ b/.github/workflows/feature-ideation.yml @@ -182,7 +182,7 @@ jobs: discussions: write id-token: write actions: read - uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref with: # All values below come from `needs.prep.outputs.*` (resolved in the `prep` # job) — NOT the `inputs` context — so this reusable `with:` compiles on the