feat: implement issue #750 — [Phase 2] Pure mapping helper: changed files -> impacted shared surfaces + consumers

[don-petry]

Closes #750

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 35 minutes and 59 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1b772353-66cf-4439-8728-06e9da89b79d

📥 Commits

Reviewing files that changed from the base of the PR and between 9ae7e2a and 046d7cb.

📒 Files selected for processing (4)

• .github/workflows/lint.yml
• scripts/lib/downstream-impact.sh
• tests/fixtures/downstream-impact/manifest.json
• tests/test_downstream_impact_map.bats

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-750-20260618-1736

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-18T18:51:12Z.

[gemini-code-assist]

Code Review

This pull request introduces a new bash helper script scripts/lib/downstream-impact.sh along with associated test fixtures and unit tests in tests/test_downstream_impact_map.bats to map PR file changes to downstream consumers. The feedback suggests two improvements: explicitly comparing the result of index(...) to null in the jq script to improve readability and avoid confusion around truthy values, and replacing echo with printf in the test suite to ensure robust and portable variable output.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

- ✅ **`printf` instead of `echo` in tests** — All instances of `echo "$output"` in `tests/test_downstream_impact_map.bats` replaced with `printf '%s\n' "$output"` for portable variable output
**CI Status:**
- All core checks passed ✅
- No Tier 1 blockers (no CHANGES_REQUESTED reviews, no failed checks)
- dev-lead ci-relay/dispatch intentionally cancelled per `[skip ci-relay]` commit flag
**Files changed (already complete):**
- `scripts/lib/downstream-impact.sh`
- `tests/test_downstream_impact_map.bats`
- `.github/workflows/lint.yml`
**Conclusion:** No action needed — the PR is ready. All actionable feedback has been addressed and the Quality Gate has passed.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 046d7cb78d8fc74e7ad41a1ad2192534584e7c9f
Review mode: triage-approved (single reviewer)

Summary

Adds a pure, network-free bash+jq helper (compute_downstream_impact) mapping a PR's changed files to impacted shared surfaces and exact-matched consumers, plus a fixture manifest and a 16-case bats suite, and registers the new bats file in lint.yml. Pure logic only — not yet wired into the cascade (deferred to Story 4). Confirms the triage low-risk assessment.

Linked issue analysis

Closes #750. All acceptance criteria are met: (1) pure bash+jq function takes a newline-delimited changed-file list + manifest path and emits {impacted_surfaces, impacted_consumers:[{repo,via}], unmatched}; (2) exact single-hop matching — direct reusable-workflow refs and indirect scripts/lib|prompts paths via surface_sources, with a provider-prefix-stripping normaliser; (3) no false positives (no-impact paths land in unmatched); (4) the bats suite covers direct, indirect (lib + prompts), no-impact, multi-surface union, dedup, and defensive-degradation cases; (5) shellcheck passes in CI.

Findings

No blocking issues. The jq uses 'index($c) != null' rather than relying on jq truthiness, which correctly addresses Gemini's readability note (index returns 0 for the first element). Defensive degradation to an empty well-formed object on missing/malformed manifest, missing args, or jq failure is implemented and tested. Advisory-bot feedback resolved: Gemini's explicit-null-comparison and printf-over-echo suggestions are both reflected in the final commit; SonarCloud Quality Gate passed (0 new issues); the Codex comment was only a usage-limit notice, and CodeRabbit/Codex were rate-limited rather than reporting findings.

CI status

All required checks green: Lint/ShellCheck/bats/unit-tests/validate-fixtures, CodeQL (actions+python), AgentShield, Holdout Guard, SonarCloud, Secret scan. The 'dev-lead / dispatch' and 'dev-lead / ci-relay' CANCELLED results are intentional (commit carries [skip ci-relay]); dependency-audit sub-jobs SKIPPED as no matching ecosystems changed. mergeStateStatus is BLOCKED only on the required org-leads human review (REVIEW_REQUIRED) — expected, not a defect.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.