[don-petry]

Ring-1 of the consumer fan-out (combsmith/.github-private#536).

Converts markets' pr-review.yml from the lossy wrapper chain (pr-review-reusable.yml@<sha> → pr-review.yml@main, no agent_ref, drops the classic PAT) to a direct pinned call: uses: …/pr-review.yml@pr-review/stable with agent_ref: pr-review/stable + secrets: inherit.

Gains: validated known-good version (not bleeding main); agent scripts pinned (#506); classic PAT for approvals (forwarded via inherit — fine-grained can't addPullRequestReview); modern triggers incl. check_suite (reviews at green CI).

Future promotions = moving pr-review/stable centrally; this file never changes again. After merge I'll validate a real review fires+approves (ring-1 healthy), then ring-2.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 4 minutes and 15 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 78b4aafa-9dd1-4702-8426-38cd8bcda136

📥 Commits

Reviewing files that changed from the base of the PR and between 0ed7423 and 1354b50.

📒 Files selected for processing (1)

• .github/workflows/pr-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/pin-pr-review-stable

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
```
No actionable issues — the bot comment was empty, there are no open threads from the bot, and all completed CI checks passed or were skipped. The PR changes only update `.github/workflows/pr-review.yml` to pin the workflow to the `pr-review/stable` channel.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
No Tier 1 blockers. No open bot review threads. No actionable findings.
PR is clean and unblocked pending in-progress CI checks.
```

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
```
No action required — the PR is unblocked pending the in-progress copilot reviewer check completing.

[Copilot]

Pull request overview

Pins the repository’s PR Review agent workflow to the org’s pr-review/stable channel and updates the event triggers/inputs so markets consumes the centrally-promoted “known good” PR review workflow + agent scripts.

Changes:

• Switch reusable workflow call to petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable and pass agent_ref: pr-review/stable with secrets: inherit.
• Update trigger set (adds check_suite, pull_request_review, repository_dispatch) and refactors workflow_dispatch inputs to pr_url + flags.
• Adjust permissions from a blank workflow-level block to explicit scopes (currently at workflow level).

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 1354b50c96eb108b1169446fb3424d22665828b4
Review mode: triage-approved (single reviewer)

Summary

Ring-1 fan-out: converts markets' pr-review.yml thin caller from the wrapper-chain pin (pr-review-reusable.yml@<sha>) to a direct call against pr-review.yml@pr-review/stable with matching agent_ref: pr-review/stable and secrets: inherit. Owner-authored, +43/-14 in a single workflow file. Triage tier classified this as low-risk; this confirmation review agrees.

Linked issue analysis

No closingIssuesReferences — this is a configuration refactor without a tracked issue. PR body references the parent fan-out task petry-projects/.github-private#536 and the pinned-scripts work in #506 as context, which is appropriate. No issue closure required.

Findings

• Permissions explicit and minimal: contents: read, pull-requests: write, checks: read — scoped to what the reusable workflow needs (replaces prior permissions: {} which would have blocked the new reusable from acting).
• Moving tag (@pr-review/stable) is intentional, not a slip: the PR body documents the central-promotion model (Future promotions = moving pr-review/stable centrally; this file never changes again). The reusable workflow lives in the same org (petry-projects/.github-private), so the trust model matches existing org-internal automation. agent_ref pins the agent scripts to the same channel, keeping logic + scripts in lockstep.
• Trigger surface refresh: drops pull_request_review_comment and issue_comment (now handled centrally via repository_dispatch: pr-review-mention), adds check_suite: completed and pull_request_review: [submitted, dismissed], narrows pull_request types to [ready_for_review, reopened, synchronize]. Matches the validated template noted in the PR body.
• Concurrency block removed: now owned by the reusable workflow — correct delegation.
• No secrets, credentials, migrations, or untrusted code execution introduced. secrets: inherit forwards DON_PETRY_BOT_GH_PAT_CLASSIC as called out in the body (fine-grained PATs can't addPullRequestReview).

CI status

All required checks green or correctly skipped: AgentShield, CodeQL (actions), SonarCloud, Secret scan (gitleaks), dependency-audit dispatch, dev-lead dispatch, pr-auto-review check-and-dispatch all SUCCESS. Language-specific CI (Backend/Frontend, npm/pnpm/govulncheck/cargo/pip audits) appropriately skipped for a workflow-only change. No failing or pending checks.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.