fix(ci): pin dependabot-automerge reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml from the floating @v1 tag to the commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (with # v1 comment for readability)
• Satisfies the action-pinning policy from the CI standards

Test plan

• Verify the workflow file has the SHA-pinned reference
• Confirm CI passes with the updated reference

Closes #85

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 20 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 722bba46-38b1-4f75-b9e5-2c5ebcd956bb

📥 Commits

Reviewing files that changed from the base of the PR and between d6b64d3 and 1871c50.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-85-20260418-1844

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review complete — no issues found. The change is minimal: pins the reusable workflow reference from the floating @v1 tag to its resolved commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (with a # v1 comment for readability). SHA was verified via the GitHub API.

CI checks are still queued. @don-petry — you are the CODEOWNER for this repo. Please review and merge when CI is green.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Pins the Dependabot automerge reusable workflow reference to a specific commit SHA to comply with the repository’s action-pinning policy.

Changes:

• Update reusable workflow reference from floating @v1 tag to a specific commit SHA
• Add an inline # v1 comment for readability while keeping SHA pinning

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 8db1c46e8f1ac44e5c16b5b270d288ec5b0372d1
Review mode: triage-approved (single reviewer)

Summary

Minimal, security-positive CI change. A single line in .github/workflows/dependabot-automerge.yml swaps the floating @v1 reference for @ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1, pinning the reusable workflow to an immutable commit SHA while keeping the version readable. The change is the exact remediation called for by the action-pinning policy and the linked compliance finding.

Linked issue analysis

Closes #85 (Compliance: unpinned-actions-dependabot-automerge.yml). The issue flags dependabot-automerge.yml as having one action not pinned to SHA, citing standards/ci-standards.md#action-pinning-policy. The diff resolves exactly that line — no other unpinned actions exist in this workflow, so the finding is fully addressed.

Findings

• Scope is appropriate. The PR touches only the line called out by the audit; no incidental edits or refactors are bundled in.
• SHA format is sane. ee22b427cbce9ecadcf2b436acb57c3adf0cb63d is a 40-char hex string and the PR description states it was verified against the GitHub API (and the author's self-review confirms this). The trailing # v1 comment preserves human-readable version context per the policy's recommended style.
• No new risk surface. Pinning to SHA strictly tightens the trust boundary for this reusable workflow — it cannot regress security or behavior relative to @v1.
• No outstanding review threads. The Copilot review is informational (COMMENTED) and raised no concerns; CodeRabbit hit a rate-limit notice but reported no findings.

CI status

All required checks are green on the reviewed commit:

• CodeQL — SUCCESS
• Analyze (actions) — SUCCESS
• CodeRabbit — SUCCESS
• SonarQube quality gate — passed (0 new issues, 0 hotspots)

Merge state is BLOCKED only because human review is still required by branch protection, which this approval addresses.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: LOW
Reviewed commit: 1871c503d6179d977f02106f6128177c5b6e6ecf
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

The change itself is security-positive (SHA-pinning a floating @v1 tag) and introduces no new risk — secrets: inherit was pre-existing and not touched by this PR. However, the PR has been in a CONFLICTING/DIRTY merge state since 2026-05-18, with 15+ failed automated rebase attempts, making it unmergeable; this gate failure blocks approval.

Findings

• MAJOR: PR has been in CONFLICTING/DIRTY merge state since 2026-05-18 (~2 weeks). Automated rebase has failed 15+ times. The branch must be manually rebased or re-created before merging.
• INFO: The single-line diff replaces floating @v1 tag with immutable commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1, directly satisfying the action-pinning policy (ci-standards.md) and closing issue Compliance: unpinned-actions-dependabot-automerge.yml #85. This is a security improvement, not a regression.
• INFO: secrets: inherit was already present in the file before this PR. The PR does not introduce or modify secret-passing behavior — triage signal is a false positive for this change.
• INFO: All CI checks are green on current HEAD (1871c50): CodeQL SUCCESS, Analyze (actions) SUCCESS, CodeRabbit SUCCESS, SonarQube quality gate passed (0 new issues, 0 hotspots).
• MINOR: PR has been open since 2026-04-18 (~6 weeks). The persistent merge conflict suggests that main has diverged significantly. Author should consider whether the SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d is still the correct v1 pin after rebasing.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

Superseded by automated re-review at 1871c50.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.