feat: implement issue #695 — [Fleet Monitor] petry-projects/.github-private — .github/workflows/lint.yml

[don-petry]

Closes #695

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores

  • Updated workflow dependencies to the latest compatible versions for improved security and stability.
  • Enhanced internal development tooling with better error handling, logging, and report generation capabilities.

• Tests

  • Introduced a new test execution wrapper to improve resilience and reliability of tests in CI environments.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 48 minutes and 4 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9269cb03-7055-4dc5-af07-a9c56dc364a4

📥 Commits

Reviewing files that changed from the base of the PR and between 3b8138c and 3302e64.

📒 Files selected for processing (3)

• .github/workflows/lint.yml
• scripts/engine.sh
• scripts/pr_review_health.sh

📝 Walkthrough

Walkthrough

Adds scripts/run-bats.sh as a resilient Bats test runner with graceful missing-path handling. Reorganizes engine.sh helper positions and refactors reset-time parsing to use a shared _emit_reset_iso helper. Extends pr_review_health.sh to write to GITHUB_STEP_SUMMARY and GITHUB_ENV, and sorts runs by run_number descending. Extends dev-lead agent prompts with SonarQube hotspot inference and multi-phase CI-fix guidance. Bumps three workflow action SHAs and adds a duplicate Gemini workspace trust check.

Changes

CI Scripting, Engine Reorganization, and Agent Prompt Updates

Layer / File(s)	Summary
New run-bats.sh CI wrapper scripts/run-bats.sh	New script with strict Bash settings, argument guard (exit 2), temp-file-based path collection, directory expansion to *.bats files, ::warning:: for missing paths (exit 1 if none resolve), and final bats invocation.
engine.sh function relocation and reset-time refactoring scripts/engine.sh	is_transient_failure, extract_verdict_json, and run_duck moved earlier in the file. run_duck unsets non-selected provider credentials and tees into a token-logging temp file. parse_reset_time delegates ISO conversion to _emit_reset_iso; new parse_reset_time_files greps output files and writes an empty reset marker when no match is found.
pr_review_health.sh summary output and run sorting scripts/pr_review_health.sh	Appends report file to GITHUB_STEP_SUMMARY when set; writes HAS_FAILURES to GITHUB_ENV. RUNS_SUMMARY now sorts runs by run_number descending; LOG_DIR is defaulted before the failed-run log loop.
Agent prompt extensions, validate-engines.sh patch, and workflow SHA bumps prompts/dev-lead/fix-bot-comment.md, prompts/dev-lead/fix-ci.md, scripts/validate-engines.sh, .github/workflows/initiative-planner.yml	fix-bot-comment.md adds SonarCloud hotspot inference block. fix-ci.md adds Phase 2–4 procedural guidance. validate-engines.sh adds a duplicate GEMINI_CLI_TRUST_WORKSPACE check. initiative-planner.yml bumps actions/checkout and anthropics/claude-code-action SHAs.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related issues

• petry-projects — workflow failures detected 2026-06-16 #764: Changes to scripts/engine.sh, scripts/pr_review_health.sh, scripts/validate-engines.sh, and dev-lead prompts directly address the CI/CD failures documented in that Fleet Monitor report.
• #695: The new scripts/run-bats.sh wrapper and engine/health script improvements address the DEGRADED lint.yml failure rate by making the Bats test execution more resilient to missing paths.

Possibly related PRs

• petry-projects/.github-private#102: Both PRs modify scripts/engine.sh in run_duck's DUCK_ENGINE routing and credential-unsetting behavior.
• petry-projects/.github-private#580: Both PRs modify scripts/engine.sh's reset-time parsing helpers (parse_reset_time/parse_reset_time_files) in the rate-limit handling path.
• petry-projects/.github-private#527: Both PRs modify scripts/pr_review_health.sh's HAS_FAILURES/GITHUB_ENV output and run aggregation logic.

Suggested labels

needs-human-review

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title references issue #695 and mentions a specific workflow file, but the actual changes encompass multiple scripts, prompts, and workflows beyond just the lint.yml workflow mentioned in the title.	Update the title to accurately reflect the main scope of changes—resilience improvements to test execution and reporting—rather than narrowly implying only lint.yml workflow changes.
Out of Scope Changes check	⚠️ Warning	The PR includes substantial refactoring changes beyond the core fix: engine.sh reorganization, pr_review_health.sh reporting restructuring, validate-engines.sh duplication, initiative-planner.yml action-SHA updates, and multiple prompt documentation additions that appear unrelated to resolving the lint.yml failure rate.	Separate core lint.yml remediation changes (run-bats.sh) from unrelated refactoring tasks into distinct PRs to maintain focused, reviewable changesets with clear objectives.
Docstring Coverage	⚠️ Warning	Docstring coverage is 69.57% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The PR implements a resilient run-bats.sh wrapper that allows workflows to continue when test files are missing (issuing warnings instead of failures), directly addressing the root cause of lint.yml failures documented in issue #695.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-695-20260614-0956

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a resilient wrapper script scripts/run-bats.sh to run bats tests, skipping missing test files with a warning instead of aborting the entire run, along with corresponding unit tests in tests/test_run_bats.bats. The feedback suggests using [ -e "$f" ] instead of [ -f "$f" ] to ensure directories containing test files are also supported.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

   - `coderabbitai[bot]`: APPROVED
   - `don-petry`: COMMENTED
   - `gemini-code-assist[bot]`: COMMENTED with suggestion for `[ -e "$f" ]` — **already resolved and marked outdated** by the PR author (the script already uses the correct check)
### Conclusion
There are **zero Tier 1 blockers** and **no actionable issues** to address. The PR is clean:
- SonarCloud found no new issues
- All CI checks passed
- The code review feedback about using `[ -e "$f" ]` instead of `[ -f "$f" ]` was already addressed in the current commit
- The test file `tests/test_run_bats.bats` even includes a test case for directory support, confirming the implementation is correct
The PR is ready to merge.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.