chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

User description

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• dev-lead.yml
• pr-auto-review.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

---

CodeAnt-AI Description

Sync org workflow stubs to the new v1-stable channel and add a fallback for auto-review secrets

What Changed

• dev-lead now points to the v1-stable release channel instead of the older stable channel
• pr-auto-review now uses the v1-stable release channel
• pr-auto-review can use a fallback workflow secret when the primary one is not set, which helps the review check keep working in more repos
• The auto-review stub now includes clearer setup guidance for copying it into a repository and naming the CI workflow it listens for

Impact

✅ Fewer auto-review setup failures
✅ More consistent workflow updates across repos
✅ Clearer PR readiness checks

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	f21db07	Jul 22, 2026 · 17:33	17:34

_{Updated in place by CodeAnt AI · last 5 reviews}

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 2f46b753-3fc1-4054-8220-78107b147d07

📥 Commits

Reviewing files that changed from the base of the PR and between 65594d5 and f21db07.

📒 Files selected for processing (2)

• .github/workflows/dev-lead.yml
• .github/workflows/pr-auto-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260722

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[qodo-code-review]

PR Summary by Qodo

Sync org-standard dev-lead and pr-auto-review workflow stubs to v1-stable

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Update dev-lead workflow stub to call the dev-lead/v1-stable reusable channel.
• Update PR auto-review stub to the pr-auto-review/v1-stable channel and clarify edit rules.
• Add canonical-first secret fallback for GH_PAT_WORKFLOWS when invoking the reusable.

Diagram

graph TD
  A["Repo workflows"] --> B["dev-lead.yml stub"] --> C[["dev-lead reusable"]]
  A --> D["pr-auto-review.yml stub"] --> E[["pr-auto-review reusable"]]
  D --> F[("Org secrets")]
  C --> G["agent_ref: v1-stable"]

  subgraph Legend
    direction LR
    _stub["Workflow stub"] ~~~ _reuse[["Reusable workflow"]] ~~~ _sec[("Secrets")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin reusables to immutable @vn or @

• ➕ Fully deterministic builds with no surprise behavior changes
• ➕ Easier bisecting/regression tracking per repo
• ➖ Conflicts with the org moving-channel rollout/rollback/compliance model described in the stub comments
• ➖ Increases operational overhead to fan out updates across all repos

2. Wrap the reusable with a repo-local intermediary reusable

• ➕ Provides an internal stability layer and room for repo-specific overrides
• ➕ Can insulate repos from central changes with an extra pin point
• ➖ Adds another layer to debug and maintain
• ➖ Tends to drift from the org-standard contract and defeats centralized governance

Recommendation: Keep the current approach: thin caller stubs that reference the org’s moving v1-stable channels. This aligns with the stated compliance/operational model (central tag moves for rollout/rollback), while still allowing controlled upgrades by channel promotion rather than per-repo edits.

Files changed (2) +22 / -23

Other (2) +22 / -23

dev-lead.ymlMove dev-lead reusable reference to dev-lead/v1-stable +4/-4

Move dev-lead reusable reference to dev-lead/v1-stable

• Updates the reusable workflow pin and the threaded agent_ref from dev-lead/stable to dev-lead/v1-stable. Keeps the moving-channel model while shifting to the v1-stable channel naming.

.github/workflows/dev-lead.yml

pr-auto-review.ymlSwitch PR auto-review to v1-stable and add PAT secret fallback +18/-19

Switch PR auto-review to v1-stable and add PAT secret fallback

• Updates documentation to enforce the moving-channel pin (pr-auto-review/v1-stable) and clarifies what repo owners may edit. Switches the reusable reference to the v1-stable channel and adds a canonical-first fallback when providing GH_PAT_WORKFLOWS to the reusable.

.github/workflows/pr-auto-review.yml

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-22T18:36:41Z.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 138 rules

✅ Skills: 6 invoked

  bmad-testarch-ci

  bmad-testarch-trace

  bmad-testarch-atdd

  bmad-testarch-framework

  bmad-testarch-automate

  bmad-testarch-test-review

1. Missing fork/Dependabot guard 🐞 Bug ☼ Reliability

Description

The PR Auto-Review workflow still triggers on pull_request and pull_request_review, but the job no
longer skips fork-origin and Dependabot PRs before calling the reusable workflow. In those contexts
repository secrets are unavailable, so the reusable will be invoked without GH_PAT_WORKFLOWS and is
expected to fail.

Code

.github/workflows/pr-auto-review.yml[R47-58]

jobs:
  pr-auto-review:
-    # Skip pull_request / pull_request_review events from forks and Dependabot:
-    # secrets are unavailable in those contexts, so the reusable's GH_PAT_WORKFLOWS
-    # call would fail. The later workflow_run path runs with secrets after CI finishes.
-    if: >
-      github.event_name != 'pull_request' && github.event_name != 'pull_request_review' ||
-      (github.event.pull_request.head.repo.full_name == github.repository &&
-       github.event.pull_request.user.login != 'dependabot[bot]')
    permissions:
      pull-requests: read
      checks: read
      actions: read
-    uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/stable  # NOSONAR(githubactions:S7637) first-party channel ref
+    uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
    secrets:
-      GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }}
+      # Canonical-first fallback (.github-private#1326). The reusable resolves this
+      # secret BY NAME, so only the VALUE changes — the passed key stays named
+      # GH_PAT_WORKFLOWS.
+      GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}

Relevance

⭐⭐⭐ High

Same fork/Dependabot secrets-availability guard was accepted in PR #245 for this exact workflow/job.

PR-#245

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow is explicitly configured to run on pull_request/pull_request_review, and the job
immediately calls the reusable with a PAT secret mapping but without any conditional guard. A
previously accepted fix in this exact file area documents that the guard is needed because secrets
are unavailable for fork/Dependabot contexts, causing the reusable call to fail.

.github/workflows/pr-auto-review.yml[27-58]
PR-#245

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`.github/workflows/pr-auto-review.yml` invokes a secret-dependent reusable workflow on `pull_request` / `pull_request_review` events, but it no longer has the `if:` guard that skips fork-origin PRs and Dependabot PRs where secrets are unavailable. This causes failing auto-review runs for those PRs.

## Issue Context
The workflow is triggered by `pull_request` and `pull_request_review`, and the job passes `GH_PAT_WORKFLOWS` to the reusable. Previously, an `if:` condition prevented invocation in fork/Dependabot contexts.

## Fix
Reintroduce an `if:` condition on the `jobs.pr-auto-review` job (or otherwise restructure triggers) to avoid calling the reusable for fork-origin PRs and Dependabot PRs on `pull_request` / `pull_request_review` events; rely on `workflow_run` (and other secret-available paths) for those cases.

## Fix Focus Areas
- .github/workflows/pr-auto-review.yml[27-58]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: f21db077c1a86b681571d916f12a650bd21a7f68
Cascade: triage → audit (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)

Summary

Verbatim, byte-identical sync of two thin caller stubs from petry-projects/.github standards (sanctioned deploy path; both v1-stable channel tags exist). The GH_PAT_DON_PETRY-first secret handoff is a documented org-wide cutover (.github-private#1326: it is the new canonical org secret, GH_PAT_WORKFLOWS is being retired) — no secret exposure, though the PAT's scope cannot be verified from this vantage. However, the removed fork/Dependabot if-guard is a confirmed regression: the upstream reusable at pr-auto-review/v1-stable performs no internal skip and immediately uses the PAT in gh calls, the stub still triggers on pull_request/pull_request_review, and markets is public with forking enabled and active Dependabot — those runs will fail red (fail-closed, reliability not exposure). Escalating for human decision; the fix belongs upstream in the central standards repo, not in this stub.

Findings

• MAJOR: Confirmed: the fork/Dependabot if-guard removal is a regression. Verified the reusable at pr-auto-review/v1-stable has no internal fork/Dependabot skip — its first steps run gh with GH_TOKEN from the passed secret, which is empty in fork/Dependabot pull_request contexts (secrets unavailable). markets is public (allow_forking=true) with active Dependabot, so external-fork and Dependabot PRs will get failing pr-auto-review checks on pull_request/pull_request_review events; only the workflow_run path (base-repo context, secrets present) works. Failure mode is fail-closed (no secret exposure or privilege escalation), but this reverses the deliberate guard from PR feat: add pr-auto-review.yml workflow (compliance automation Phase 2) #245 and may block/noise the Dependabot automerge pipeline. Fix must land in petry-projects/.github standards or the reusable itself — per org model this stub must not be edited locally. (.github/workflows/pr-auto-review.yml:47)
• MINOR: GH_PAT_DON_PETRY-primary handoff verified as documented org governance (.github-private#1326: org-level secret created 2026-07-19; GH_PAT_WORKFLOWS is being retired, fallback is transitional and slated for removal after cutover confirmation). No literal secret exposed; only secrets.* references. Residual, unverifiable from this repo: whether the classic PAT's scope is minimal (reusable requires repo scope) — org admins should confirm during the #1326 cutover checklist. Bus-factor of a person-named PAT driving org automation is an accepted, documented decision, not introduced by this PR. (.github/workflows/pr-auto-review.yml:58)
• INFO: Moving-channel refs (dev-lead/v1-stable, pr-auto-review/v1-stable) are mutable first-party tags — verified both tags exist in their respective org repos. This is the documented org rollout model (frozen pins rejected by compliance audit) and predates this PR (stable was equally mutable); rename-only change, no new supply-chain surface. (.github/workflows/pr-auto-review.yml:54)
• INFO: Standards compliance verified: both files at PR head are byte-identical to standards/workflows/ in petry-projects/.github, opened by the deploy script under the sanctioned standards-sync flow. CODEOWNERS routes to @petry-projects/org-leads (reviewDecision REVIEW_REQUIRED, mergeStateStatus BLOCKED) and the repo's own bot has withheld auto-approval pending advisory-bot recovery, so human review remains gated regardless of this verdict. (N/A)
• INFO: dev-lead.yml is a pure stable->v1-stable channel rename in uses: and agent_ref; tag exists; no independent risk. (.github/workflows/dev-lead.yml:66)

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.