fix: restore S7635 NOSONAR marker on dev-lead secrets: inherit

[don-petry]

User description

Meta-repo quality fix (#879). This dev-lead channel-consumer stub had the correct pin but was missing the inline # NOSONAR(githubactions:S7635) marker on secrets: inherit (regressed during #857). Restores it so SonarCloud S7635 stays suppressed and the marker-aware driver (#878) sees it compliant (no churn). Pin unchanged.

Summary by CodeRabbit

• Chores
  • Clarified the trusted status of the development workflow configuration for automated code-quality checks.

---

CodeAnt-AI Description

Restore the Sonar marker on the dev-lead workflow secret handoff

What Changed

• Restored the inline Sonar suppression comment on the secrets: inherit line in the dev-lead workflow
• Keeps the existing secret-sharing behavior unchanged while preventing the file from being flagged again

Impact

✅ Fewer false Sonar warnings
✅ Cleaner workflow checks
✅ No change to dev-lead secret access

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	4c1a153	Jul 22, 2026 · 17:29	17:29

_{Updated in place by CodeAnt AI · last 5 reviews}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5353e648-ec30-4420-9302-a949d401546e

📥 Commits

Reviewing files that changed from the base of the PR and between ab0fa1b and 4c1a153.

📒 Files selected for processing (1)

• .github/workflows/dev-lead.yml

---

📝 Walkthrough

Walkthrough

The dev-lead reusable workflow invocation retains inherited secrets and adds an inline githubactions:S7635 NOSONAR comment identifying the usage as first-party trusted.

Changes

Sonar suppression

Layer / File(s)	Summary
Mark inherited secrets as trusted .github/workflows/dev-lead.yml	Adds the first-party trusted Sonar suppression comment to secrets: inherit without changing workflow behavior.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• [#850] defense-in-depth: in-place repin path should inject the S7635 marker (latent, guard against future config) #879 — Adds the same githubactions:S7635 first-party trusted marker to inherited secrets.
• [#850] make standards-deploy driver treat a missing S7635 marker as drift (propagate #876 markers to already-pinned consumers) #877 — Updates compliance logic related to detecting and propagating this marker.

Possibly related PRs

• petry-projects/.github#567 — Applies the same NOSONAR marker pattern to other reusable-workflow stubs.
• petry-projects/.github#876 — Makes the same marker change in dev-lead.yml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes restoring the S7635 NOSONAR marker on the dev-lead secrets: inherit line.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-dev-lead-s7635-marker

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/dev-lead.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

PR Summary by Qodo

Restore NOSONAR S7635 marker for secrets: inherit in dev-lead workflow

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Restore the inline # NOSONAR(githubactions:S7635) marker on secrets: inherit.
• Keep SonarCloud S7635 suppression stable and avoid marker-driver compliance churn.
• Preserve the existing reusable workflow pin (no version/pin changes).

Diagram

graph TD
A[".github/workflows/dev-lead.yml"] --> B["dev-lead-reusable.yml"] --> C["GitHub Actions runner"]
A --> E["Marker-aware driver"] --> D{{"SonarCloud S7635"}}
A -. "NOSONAR for secrets" .-> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Disable/adjust S7635 centrally (SonarCloud config)

• ➕ Avoids per-workflow inline suppressions and comment churn
• ➖ Broader blast radius; may hide real findings elsewhere
• ➖ May not satisfy marker-aware tooling expectations scoped to specific lines/constructs

2. Avoid `secrets: inherit` by explicitly mapping required secrets

• ➕ Removes need for S7635 suppression entirely
• ➕ More explicit secret surface area
• ➖ Higher maintenance cost as reusable workflow inputs change
• ➖ Harder to keep consistent across many workflow stubs

Recommendation: Keep the PR’s approach: restoring the inline, scoped NOSONAR marker is the smallest, least risky fix that maintains the existing trust/pin model and keeps both SonarCloud and the marker-aware driver stable.

Files changed (1) +1 / -1

Bug fix (1) +1 / -1

dev-lead.ymlRe-add S7635 NOSONAR marker for 'secrets: inherit' +1/-1

Re-add S7635 NOSONAR marker for 'secrets: inherit'

• Restores the inline '# NOSONAR(githubactions:S7635)' comment on the 'secrets: inherit' line. This keeps SonarCloud S7635 suppressed and maintains compliance with marker-aware validation tooling without changing the reusable workflow pin.

.github/workflows/dev-lead.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.