Repository navigation
docs(dev-lead): concurrency ownership, @main pin, and the permission contract - #404
Conversation
…sion contract Codifies the design that #402 settled, and corrects the standard where it wrongly described dev-lead as a public .github @v1 reusable: - New "Concurrency, pinning, and the permission contract" subsection: stubs carry no concurrency block (centralized per-lane in the reusable); stubs pin .github-private/...dev-lead-reusable.yml@main for immediate fix propagation; stubs must grant the full permission set the reusable requests (incl. statuses:read) or consumers startup_failure; dev-lead:hands-off label opt-out. - Pinning policy: add a dev-lead carve-out (private repo, @main) and fix the example that showed dev-lead pinned to .github @v1 — it lives in .github-private. Refs #402 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 14 minutes and 22 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the CI standards documentation to detail the concurrency, pinning, and permission contracts for the dev-lead agent, including its exception to track the @main branch in the private repository. Feedback points out a grammatical typo in the permissions section and notes that the template workflow file standards/workflows/dev-lead.yml needs to be updated to include the statuses: read permission to prevent startup failures for adopting repositories.
There was a problem hiding this comment.
Pull request overview
Updates the org CI standards documentation to codify the dev-lead agent’s ownership boundaries (concurrency, pinning, and permissions) and to correct internal pinning guidance now that dev-lead’s reusable workflow lives in petry-projects/.github-private and tracks @main.
Changes:
- Document a
dev-leadexception to the normal “pin reusables to tags” guidance, explicitly noting the private repo +@maintracking model. - Expand the internal reusable-workflow pinning exception to include
petry-projects/.github-private, and correct the dev-leaduses:examples accordingly. - Add a new “Concurrency, pinning, and the permission contract” subsection under Dev-Lead Agent describing centralized concurrency lanes and required caller permissions (including
statuses: read) plus thedev-lead:hands-offopt-out.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 33099f27d5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Addresses bot review feedback on #404: - "caller-permission" -> drop the ambiguous compound ("permission and security fixes") so it doesn't read as an inconsistent spelling of the caller-permissions guard (copilot, x2). - "full set the reusable requests" -> "full set that the reusable requests" (gemini). - `.github-private#448` in backticks -> petry-projects/.github-private#448 so the cross-repo reference autolinks, matching the other references (copilot). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
.github/standards/ci-standards.md
Line 1239 in cc0ac22
Align the template with the required PAT secret
This line makes GH_PAT_WORKFLOWS required for access to the private .github-private workflow resources, but the file adopters are told to copy verbatim (standards/workflows/dev-lead.yml) still says GH_PAT_WORKFLOWS is optional/only needed if Claude pushes workflow files. A new repo that trusts the copied header can omit the PAT and then run dev-lead without the secret this standard now says is required for cross-repo script access. Please update the template header and any shims alongside the standard.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| To exclude a specific PR or issue from the agent — e.g. a PR that edits the | ||
| dev-lead workflow itself, so the agent doesn't pile commits onto its own infra | ||
| change — add the **`dev-lead:hands-off`** label; the classifier then skips every |
There was a problem hiding this comment.
This new escape-hatch relies on a dev-lead:hands-off label, but the standard label set and the label automation I checked (standards/github-settings.md and scripts/apply-repo-settings.sh) only create the existing standard labels and do not include this one. In repos managed by these settings, maintainers following this instruction will not be able to apply the label until it is manually created, so the classifier cannot skip the PR/issue. Please add the label to the standard/automation, or document an explicit creation step, with this guidance.
Useful? React with 👍 / 👎.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: cc0ac22112d2ead2ebe76fe28c99f693bf95c358
Review mode: triage-approved (single reviewer)
Summary
Docs-only update to standards/ci-standards.md (+57 / -5) that:
- Adds an Exception —
dev-leadnote to the reusable-pinning policy, plus a new Concurrency, pinning, and the permission contract subsection under Dev-Lead Agent. - Updates the internal-reusable carve-out to cover
petry-projects/.github-privateand corrects the example that pinneddev-lead-reusable.yml@v1under public.github(it actually lives in.github-privateand tracks@main). - Documents the
dev-lead:hands-offopt-out label.
This is exactly the kind of low-risk standards write-up that triage flagged for fast-track confirmation.
Linked issue analysis
No closes/fixes linkage; the PR body references #402 as the design issue being codified, with #403 (template + shim back-fill) and #405 (compliance-audit guard) as paired follow-ups. The scope of this PR matches its stated intent: documentation only.
Findings
No blocking issues introduced by this PR. Coverage of prior bot feedback:
- Gemini / Copilot / Codex (round 1, on 33099f2): terminology nit (
caller-permissionvscaller-permissions), grammar nit ("full set the reusable requests"), and autolink-formatting nit on.github-private#448. All three were addressed in the follow-up commitcc0ac22. - Codex P2 — template
concurrency:block (line 1198): the new rule bans aconcurrency:block in stubs, butstandards/workflows/dev-lead.ymlstill ships one. Author response on-thread confirms removal is in #403; this PR documents the post-#403 target state. Acceptable — the standard and template will land in a coordinated series. - Codex P1 — template missing
statuses: read(line 1220): same situation.statuses: readis added to the template and back-filled to all shims in #403. Caller-permissions CI guard enforces template-first ordering, so the temporary doc/template skew during this series is the intended sequence. - Codex P2 — audit guard still expects old
@v1path: addressed in #405 per the author response. - Codex P2 —
dev-lead:hands-offlabel not in org label automation (line 1232): unresolved on-thread, but only a documentation/automation tracking gap — the standard correctly describes the label semantics; maintainers can create it manually until label automation is updated. Worth a follow-up issue but not blocking for a docs PR. - Codex top-level —
GH_PAT_WORKFLOWSlisted as required at line 1239 but the template header still calls it optional: the line cited (Adopting the Dev-Lead Agentstep 3) is not modified by this PR — it pre-dates this change. Not a regression introduced here; worth tracking separately but out of scope for this PR.
No security, secrets, auth, migration, or workflow-permission code changes. No supply-chain edits. Docs-only diff.
CI status
All required checks green on cc0ac22:
- AgentShield ✓
- CI / Lint ✓
- CI / ShellCheck ✓
- CI / Agent Security Scan ✓
- CI / Secret scan (gitleaks) ✓
- CodeQL (actions) ✓
- SonarCloud / SonarCloud Analysis ✓ (Quality Gate passed, 0 new issues)
- Dependency audit ecosystems detected, all language-specific audits SKIPPED (no manifests changed) ✓
- Dependabot auto-merge: SKIPPED (expected — not a dependabot PR)
- CodeRabbit: APPROVED on this SHA
mergeStateStatus is BLOCKED solely because org-leads review is required.
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1b7fe4240a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| > **Exception — `dev-lead`.** The dev-lead reusable lives in the private | ||
| > `petry-projects/.github-private` repo (it checks out private prompts/scripts) | ||
| > and is pinned `@main`, not a tag — so permission and security fixes | ||
| > propagate immediately instead of waiting for a tag bump or the monthly | ||
| > standards-sync. See [Dev-Lead Agent](#dev-lead-agent). |
There was a problem hiding this comment.
This new exception says dev-lead lives in .github-private and tracks @main, but the Tier 1 table just above still includes dev-lead.yml in a generic rule that says stubs delegate to petry-projects/.github/...@<version> and that the matching reusable lives in this repo. Readers and compliance agents following the table before this carve-out can still generate or validate the old public @v1 shape, so please update the Tier 1 row to either exclude dev-lead or explicitly mention the private @main exception there as well.
Useful? React with 👍 / 👎.
|
…contract (#404) * docs(dev-lead): document concurrency ownership, @main pin, and permission contract Codifies the design that #402 settled, and corrects the standard where it wrongly described dev-lead as a public .github @v1 reusable: - New "Concurrency, pinning, and the permission contract" subsection: stubs carry no concurrency block (centralized per-lane in the reusable); stubs pin .github-private/...dev-lead-reusable.yml@main for immediate fix propagation; stubs must grant the full permission set the reusable requests (incl. statuses:read) or consumers startup_failure; dev-lead:hands-off label opt-out. - Pinning policy: add a dev-lead carve-out (private repo, @main) and fix the example that showed dev-lead pinned to .github @v1 — it lives in .github-private. Refs #402 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(dev-lead): fix review nits — terminology, grammar, autolink Addresses bot review feedback on #404: - "caller-permission" -> drop the ambiguous compound ("permission and security fixes") so it doesn't read as an inconsistent spelling of the caller-permissions guard (copilot, x2). - "full set the reusable requests" -> "full set that the reusable requests" (gemini). - `.github-private#448` in backticks -> petry-projects/.github-private#448 so the cross-repo reference autolinks, matching the other references (copilot). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Code Bot <noreply@anthropic.com>
Codifies in
ci-standards.mdthe design that #402 settled, and corrects the standard where it described dev-lead as a public.github@v1reusable (it actually lives in.github-privateand tracks@main).Changes
concurrency:block — it's centralized per-lane in the reusable (why: per-stub concurrency drifted and starved issue pickups; safe to parallelize since feat(feature-ideation): auto-enhance new Ideas Discussions on creation #448 isolates checkouts)..github-private/...dev-lead-reusable.yml@mainfor immediate propagation of permission/security fixes.statuses: read) or consumersstartup_failure; thecaller-permissionsCI guard enforces the template-first ordering.dev-lead:hands-offlabel opt-out.@main) and fix the example that showed dev-lead pinned to.github@v1.Pairs with the compliance-check PR (separate) that enforces these stub invariants. Part of the #402 follow-ups.
🤖 Generated with Claude Code