feat: implement issue #591 — bug(initiative-planner): claude-code-action rejects discussion events — the idea:approved auto-trigger never plans

[don-petry]

Closes #591

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 56 minutes and 52 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 487cb328-4778-4c12-9721-590aaa69316f

📥 Commits

Reviewing files that changed from the base of the PR and between 29e5974 and 9615a63.

📒 Files selected for processing (5)

• .github/workflows/initiative-planner.yml
• .github/workflows/lint.yml
• scripts/initiative-planner/README.md
• scripts/initiative-planner/redispatch.sh
• tests/test_initiative_planner_redispatch.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-591-20260612-0123

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces redispatch.sh to bridge the discussion [labeled] event to a workflow_dispatch event, addressing a limitation where claude-code-action does not support discussion event contexts. It also adds a comprehensive BATS test suite for the script and updates the README documentation. The review feedback suggests enhancing redispatch.sh to support the DRY_RUN environment variable and branch-specific dispatching via GITHUB_REF (to enable testing on feature branches), along with adding corresponding unit tests for these new features.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #618
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-12T02:07:41Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-12T02:07:41Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 3cb14827759d6ed2b8bccb8523f71cabbc23796c
Review mode: triage-approved (single reviewer)

Summary

Implements the re-dispatch bridge (fix option 1 from issue #591): a new redispatch job catches the discussion[labeled] idea:approved event and re-invokes the planner via workflow_dispatch, where claude-code-action runs cleanly. Includes a new validated shell script, 10 BATS tests wired into lint.yml, and README updates. Triage cleared this as low-risk; I rate it MEDIUM (workflow change consuming an existing PAT secret) but it is safe — gated on a maintainer-applied label, minimal permissions, no injection vectors.

Linked issue analysis

Issue #591 reports the idea:approved auto-trigger never plans because claude-code-action rejects discussion event contexts. This PR implements exactly the recommended option 1 (re-dispatch pattern, no upstream dependency): the plan job is now workflow_dispatch-only and the new redispatch job bridges the discussion event. The label remains the human gate. Substantively addressed.

Findings

Security (no blockers):

• GH_PAT_WORKFLOWS usage follows the established pattern (identical PAT-guard as initiative-driver.yml:63-72); the secret is already consumed by 8+ workflows in this repo.
• Trigger is gated on a maintainer-applied idea:approved discussion label (triage+ permission required), so the PAT path is not reachable by arbitrary users.
• DISCUSSION_NUMBER is passed via env (not inline interpolation) and regex-validated (^[0-9]+$) before reaching the gh command line — injection-safe, with a BATS test covering the injection case.
• Redispatch job: contents: read only, persist-credentials: false, SHA-pinned checkout, 5-min timeout. Top-level permissions: {} retained.

Correctness:

• workflow_dispatch inputs discussion/dry_run already exist in the workflow; redispatch correctly dispatches dry_run=false for the auto path.
• Concurrency group keys on the same discussion number for both events with cancel-in-progress: false; gh workflow run is fire-and-forget so no deadlock.
• --ref is only forwarded for branch/tag refs (discussion events run from the default branch), correctly skipping refs/pull/*.

Review threads: Both gemini-code-assist threads (DRY_RUN support, GITHUB_REF support, and tests for both) were addressed in commit 3cb1482 and are resolved.

CI status

All material checks green: shellcheck, bats (incl. the 10 new tests), CodeQL (actions+python), gitleaks, AgentShield, Agent Security Scan, SonarCloud quality gate, unit-tests, gh-aw-compile, validate-agent-profiles. One CANCELLED 'review / review' check run was superseded ~20s later by a successful run of the same check on this head SHA.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 9615a63996998aca02da3889d3eed71355df0da3
Review mode: triage-approved (single reviewer)

Summary

Re-confirmation review at the new head SHA (merge of main into the branch). The PR implements the re-dispatch bridge (fix option 1 from issue #591): a new redispatch job catches the discussion[labeled] idea:approved event and re-invokes the planner via workflow_dispatch, where claude-code-action runs cleanly. The only delta since the previously approved commit (3cb1482) is a merge of main bringing in unrelated changes from PR #609 (scripts/lib/ci-status.sh, tests/test_ci_status.bats) — no changes to this PR's own files. Triage cleared this as low-risk; I rate it MEDIUM (workflow change consuming an existing PAT secret) but it is safe.

Linked issue analysis

Issue #591 reports the idea:approved auto-trigger never plans because claude-code-action rejects discussion event contexts. This PR implements exactly the recommended option 1 (re-dispatch pattern, no upstream dependency): the plan job is now workflow_dispatch-only and the new redispatch job bridges the discussion event by resolving the discussion number and firing gh workflow run with the PAT. The idea:approved label remains the human gate. Substantively addressed.

Findings

Delta since prior approved review (3cb1482): merge commit 9615a63 only pulls main forward (PR #609 files); the PR's own diff is byte-identical to what was already approved.

Security (no blockers):

• GH_PAT_WORKFLOWS usage follows the established pattern (same PAT-guard as initiative-driver); secret already consumed by other workflows in this repo.
• Trigger gated on a maintainer-applied idea:approved discussion label, so the PAT path is not reachable by arbitrary users.
• DISCUSSION_NUMBER passed via env (not inline interpolation) and regex-validated (^[0-9]+$) before reaching the gh command line — injection-safe, with a BATS test covering the injection case.
• Redispatch job: contents: read only, persist-credentials: false, SHA-pinned checkout, 5-min timeout.

Correctness:

• workflow_dispatch inputs discussion/dry_run already exist; redispatch dispatches dry_run=false for the auto path and honors DRY_RUN=1/true.
• --ref only forwarded for branch/tag refs, correctly skipping refs/pull/*.
• 10 BATS tests wired into lint.yml and passing.

Review threads: Both gemini-code-assist threads are resolved (verified via GraphQL). No human-reviewer questions outstanding.

CI status

All material checks green at head SHA 9615a63: shellcheck, bats (incl. the new redispatch tests), CodeQL (actions+python), gitleaks, AgentShield, Agent Security Scan, SonarCloud quality gate (0 new issues, 0 hotspots), unit-tests, gh-aw-compile, validate-agent-profiles, Lint. Three CANCELLED check runs (dev-lead/dispatch, dev-lead/ci-relay, review/review) were concurrency-superseded and each has a later SUCCESS run of the same check on this head SHA.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.