feat(standards): per-repo initiative-driver caller stub (#884)

[don-petry]

Summary

Applies the cross-repo deliverable of petry-projects/.github-private#884 (Phase 2 of the driver fleet-enablement epic #882). dev-lead correctly flagged #884 as hands-off — all its ACs target this public repo, which dev-lead (running in .github-private) can't write — and produced a verified spec; this PR applies it.

• standards/workflows/initiative-driver.yml — thin caller stub. Unlike the planner stub there is no reusable: the central driver is pure-bash (no claude-code-action), so the stub dispatches the central workflow_dispatch directly via gh workflow run -R petry-projects/.github-private -f target_repo=<host>. It mirrors the central driver's initiative:auto label filter and keeps the PAT guard (a workflow_dispatch fired with GITHUB_TOKEN never starts a run).
• ci-standards.md §10 — adds the initiative-driver row (Reusable = none — direct dispatch).

Effect

On an enrolled repo's issues: [closed, labeled] initiative:auto (+ off-peak schedule), this dispatches the central driver for that repo, which releases ready sub-issues of its initiative:auto epics to dev-lead — closing the manual-release gap the .github pilot exposed. Adoptable template (not force-deployed), like the other idea-pipeline stubs.

Unblocks #886 (Fleet Monitor coverage) + #887 (docs). Refs #882, #817.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 31 minutes and 43 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f709a3fc-3077-494e-bffa-1415c0e20e5b

📥 Commits

Reviewing files that changed from the base of the PR and between 08b6be9 and f95636d.

📒 Files selected for processing (2)

• standards/ci-standards.md
• standards/workflows/initiative-driver.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/initiative-driver-stub

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a new GitHub Actions workflow, initiative-driver.yml, which acts as a thin caller stub to dispatch a central initiative-driver workflow in a private repository. It also updates the ci-standards.md documentation to reflect this addition. The review feedback suggests two improvements: enabling cancel-in-progress: true in the concurrency configuration to prevent redundant queued runs during a burst of issue events, and adding a workflow_dispatch trigger to allow manual execution of the workflow for testing and troubleshooting.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

@donpetry-bot please review — code-owner approval needed to merge. CI green, no open threads.

[don-petry]

@donpetry-bot review

[don-petry]

@donpetry-bot review

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: f95636d4f7da8b23aa45cbc51bfc239545b74ef3
Review mode: triage-approved (single reviewer)

Summary

Adds a per-repo initiative-driver.yml thin caller stub (89 lines, new) to standards/workflows/ plus one documentation row in ci-standards.md §10. The stub dispatches the central initiative-driver in petry-projects/.github-private with target_repo= on this repo's issues:[closed, labeled initiative:auto] events plus an off-peak schedule. Confirmation review of the triage-approved low-risk assessment — assessment confirmed.

Linked issue analysis

No GitHub closes-style linked issues (closingIssuesReferences is empty). The PR applies the cross-repo deliverable of petry-projects/.github-private#884 (Phase 2 of epic #882) and refs #886/#887/#817; the acceptance criteria live in the private repo and are not verifiable from here. The PR body and commit message document the linkage and rationale thoroughly, which is appropriate for a template stub that is adoptable (not force-deployed).

Findings

No blocking findings.

• Security (GitHub Actions): clean. permissions: contents: read (minimal). No untrusted event input is interpolated into run: steps — the only event field used is github.event.label.name inside an if: comparison (safe), and the dispatch passes target_repo=${{ github.repository }}, a trusted context value (no script-injection surface). No pull_request_target, no checkout/execution of untrusted code. GH_PAT_WORKFLOWS is consumed via env and only tested for presence — never echoed.
• Robustness: concurrency group is per-repo with cancel-in-progress: true (dedup safe because the central driver sweeps all epics); the job if: restricts labeled dispatches to the initiative:auto gate label, preventing fan-out on unrelated label changes; PAT-present guard fails fast with a clear error.
• Prior reviewer feedback resolved: gemini-code-assist's two suggestions (enable cancel-in-progress: true; add a workflow_dispatch trigger) are both present in the reviewed SHA. The coderabbitai review was DISMISSED/rate-limited with no actionable findings.
• Secret scanning: the run_secret_scanning MCP tool is not exposed in this environment, so it was not invoked; the gitleaks CI check passed and the diff contains no secrets (only a secrets.GH_PAT_WORKFLOWS reference).

CI status

All checks green or appropriately skipped. SUCCESS: CodeQL (Analyze actions), AgentShield, CI/Lint, CI/ShellCheck, CI/Secret scan (gitleaks), CI/Agent Security Scan, SonarCloud (Quality Gate passed), Dependency audit (Detect ecosystems), dev-lead/dispatch, pr-auto-review. SKIPPED (n/a): dependabot-automerge and the per-ecosystem audit jobs (npm/pnpm/pip/cargo/go). reviewDecision=REVIEW_REQUIRED and mergeStateStatus=BLOCKED reflect the expected code-owner (org-leads) approval gate, not a CI failure.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.