feat: implement issue #348 — SonarCloud: S7635 secrets-inherit caller stubs

[don-petry]

Closes #348

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 20ebbf99-de16-40b6-99ca-644c249c9f34

📥 Commits

Reviewing files that changed from the base of the PR and between 25da900 and a1f6bfd.

📒 Files selected for processing (2)

• .github/workflows/dependabot-automerge.yml
• .github/workflows/pr-review-mention.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-348-20260707-1916

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-07T20:20:37Z.

[Copilot]

Pull request overview

This PR addresses SonarCloud rule githubactions:S7635 (over-sharing secrets) by replacing secrets: inherit in org reusable-workflow caller stubs with explicit secret mappings, keeping behavior the same while narrowing secret exposure.

Changes:

• Updated .github/workflows/pr-review-mention.yml to pass only GH_PAT_WORKFLOWS and DON_PETRY_BOT_GH_PAT explicitly to the reusable workflow.
• Updated .github/workflows/dependabot-automerge.yml to pass only APP_ID and APP_PRIVATE_KEY explicitly to the reusable workflow.
• Expanded header guidance/comments in both stubs to document the required secrets and discourage reverting to secrets: inherit.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/pr-review-mention.yml	Replaces secrets: inherit with explicit secrets needed by the PR review mention reusable workflow.
.github/workflows/dependabot-automerge.yml	Replaces secrets: inherit with explicit secrets needed by the Dependabot automerge reusable workflow.

[don-petry]

Closing as superseded to free an automation-PR queue slot (org-wide cap is 50/50 open, blocking new dev-lead work). Driving issue #348 is already closed, and this PR is conflicted (would need a full rebase). No in-flight work is lost — re-open or re-drive the issue if anything here is still wanted.