feat: implement issue #1052 — fix(ci): prevent channel-skew workflow breakage — guard forwarded inputs vs pinned refs + codify the pinning rules (post-#1034)

[don-petry]

Closes #1052

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 9 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a06c978d-0f4a-406e-9c57-cd91320615ae

📥 Commits

Reviewing files that changed from the base of the PR and between d1016c5 and 24ac394.

📒 Files selected for processing (21)

• .github/workflows/lint.yml
• .github/workflows/pr-review-canary.yml
• AGENTS.md
• prompts/dev-lead/fix-bot-comment.md
• prompts/dev-lead/fix-issue.md
• prompts/dev-lead/fix-reviews.md
• prompts/dev-lead/on-mention.md
• prompts/dev-lead/review-changes.md
• scripts/caller_stub_freeze.sh
• scripts/pr_review_canary.sh
• scripts/validate-caller-inputs.sh
• tests/caller_stub_freeze.bats
• tests/dev-lead/fixtures/caller-inputs/caller_1034.yml
• tests/dev-lead/fixtures/caller-inputs/caller_ok.yml
• tests/dev-lead/fixtures/caller-inputs/reusable_pinned.yml
• tests/dev-lead/fixtures/caller-inputs/reusable_required.yml
• tests/dev-lead/unit/test_channel_stub_forward_guardrail.bats
• tests/dev-lead/unit/test_validate_caller_inputs.bats
• tests/fixtures/caller-stub-freeze/dev-lead.block
• tests/fixtures/caller-stub-freeze/pr-review-trigger.block
• tests/pr_review_canary.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1052-20260703-1946

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
Status: Quality Gate passed. No changes required.
```

[Copilot]

Pull request overview

Implements the prevention and guardrails for issue #1052 by adding CI checks, drift guards, canaries, and documented rules to stop “channel-skew” reusable-workflow startup failures (the #1034 startup_failure incident class) from recurring in .github-private.

Changes:

• Added a pinned-ref input compatibility validator (scripts/validate-caller-inputs.sh) and wired it into lint.yml.
• Added a ring-0 caller-stub forwarding “freeze” drift guard (scripts/caller_stub_freeze.sh) with baselines and tests.
• Added a pr-review-trigger dry-run canary workflow + script, and codified the sequencing/rules in dev-lead prompts and AGENTS.md.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/pr_review_canary.bats	Unit tests for the pure helpers in scripts/pr_review_canary.sh.
tests/fixtures/caller-stub-freeze/pr-review-trigger.block	Frozen forwarding-block baseline for pr-review-trigger.yml.
tests/fixtures/caller-stub-freeze/dev-lead.block	Frozen forwarding-block baseline for dev-lead.yml.
tests/dev-lead/unit/test_validate_caller_inputs.bats	Unit tests + regression fixture coverage for the pinned-ref input guard.
tests/dev-lead/unit/test_channel_stub_forward_guardrail.bats	Tests ensuring new “channel-pin input forwarding” guardrail text is present in prompts.
tests/dev-lead/fixtures/caller-inputs/reusable_required.yml	Fixture reusable declaring a required input (tests required-forwarding behavior).
tests/dev-lead/fixtures/caller-inputs/reusable_pinned.yml	Fixture reusable representing the lagging pinned ref (no lsp_pilot_variant).
tests/dev-lead/fixtures/caller-inputs/caller_ok.yml	Fixture caller stub with only inputs declared at the pinned ref.
tests/dev-lead/fixtures/caller-inputs/caller_1034.yml	Fixture reproducing the #1034 mismatch (extra forwarded key).
tests/caller_stub_freeze.bats	Unit tests + driver test for the stub-freeze drift guard script.
scripts/validate-caller-inputs.sh	Implements pinned-ref input validation (forwarded ⊆ declared; required forwarded).
scripts/pr_review_canary.sh	Implements dry-run canary dispatch + polling + classification/reporting.
scripts/caller_stub_freeze.sh	Implements byte-identity drift guard for ring-0 forwarding blocks.
prompts/dev-lead/review-changes.md	Adds the new channel-pin input-forwarding guardrail to dev-lead prompt.
prompts/dev-lead/on-mention.md	Adds the new channel-pin input-forwarding guardrail to dev-lead prompt.
prompts/dev-lead/fix-reviews.md	Adds the new channel-pin input-forwarding guardrail to dev-lead prompt.
prompts/dev-lead/fix-issue.md	Adds the new channel-pin input-forwarding guardrail to dev-lead prompt.
prompts/dev-lead/fix-bot-comment.md	Adds the new channel-pin input-forwarding guardrail to dev-lead prompt.
AGENTS.md	Documents the “Caller-stub input forwarding across channel pins” rule + sequencing and references enforcement.
.github/workflows/pr-review-canary.yml	New scheduled + post-merge canary workflow to detect startup_failure regressions quickly.
.github/workflows/lint.yml	Wires in new bats tests, adds validate-caller-inputs + stub-freeze jobs, and adds actionlint job.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive validation framework to prevent release-channel skew in reusable-workflow calls, addressing the #1034 startup_failure incident. It adds scripts to validate caller inputs against pinned refs, freeze ring-0 stub forwarding blocks, and run a dry-run canary, alongside updated documentation, prompts, and BATS tests. The reviewer's feedback focuses on improving script robustness and portability, including forcing git fetches on mutable tags, guarding grep commands under set -e, ignoring commented-out workflow references, using EXIT traps for reliable cleanup, ensuring macOS compatibility for base64 decoding, verifying the gh CLI dependency, and utilizing BATS_TEST_TMPDIR for automatic test file cleanup.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Closing this oversized (21-file) DIRTY attempt. Issue #1052 has been decomposed into 4 focused, sequenced sub-issues (Parts A–E) that regenerate cleanly against current main:

• [#1052 A] CI guard: forwarded caller inputs ⊆ declared inputs at the pinned @ref (+ #1034 regression) #1253 Part A — caller-input validation guard + feat: implement issue #1031 — fix(#844): plumb LSP_PILOT_ENABLED env + decouple capture from LSP wiring so the pilot A/B runs in CI #1034 regression (firing now)
• [#1052 C+E] dev-lead prompt guardrail (no undeclared channel-stub input forward) + codify in AGENTS.md & org ci-standards #1254 Parts C+E — dev-lead prompt guardrail + AGENTS.md/ci-standards codification (firing now)
• [#1052 B] Stub-freeze drift guard for ring-0 caller stubs (blocked on #1253) #1255 Part B — stub-freeze drift guard (held; release after [#1052 A] CI guard: forwarded caller inputs ⊆ declared inputs at the pinned @ref (+ #1034 regression) #1253 merges — shared lint.yml)
• [#1052 D] Baseline hygiene: actionlint + pr-review startup_failure canary (blocked on #1253) #1256 Part D — actionlint + pr-review startup_failure canary (held; release after [#1052 A] CI guard: forwarded caller inputs ⊆ declared inputs at the pinned @ref (+ #1034 regression) #1253/[#1052 B] Stub-freeze drift guard for ring-0 caller stubs (blocked on #1253) #1255)

#1052 is now the tracking epic. No work lost — the deliverables are fully specified in the sub-issues.