fix(auto-rebase): source predicate from reusable's own commit, not @v1 (restores review-ready gate)

[don-petry]

Problem

The auto-rebase review-ready gate (#465 / #468) is live nowhere — and #468 introduced a regression in petry-projects/.github itself.

The reusable defaulted tooling_ref to v1 and checked out petry-projects/.github@v1 to source lib/eligibility.sh. But eligibility.sh only landed in #468, after the v1 tag (d3d768d, 2026-05-13). So every run fails:

.auto-rebase-tooling/.github/scripts/auto-rebase/lib/eligibility.sh: No such file or directory
##[error]Process completed with exit code 1.

Evidence: petry-projects/.github's own auto-rebase is failing 5/5 recent runs (e.g. run 28103191068) while it has 8 open non-Dependabot PRs to act on. The 7 consumer repos still pin the pre-#468 reusable (v1/v2/@auto-rebase/stable/SHA), so they run the original unrestricted fan-out (verified: .github-private PR#744 — no approval, no auto-rebase:ready label — still auto-updated on the 3 most recent runs).

Fix

• Default tooling_ref to empty and resolve the tooling checkout to ${{ inputs.tooling_ref || github.job_workflow_sha }} — the commit SHA of this reusable file for the run.
• The predicate (lib/eligibility.sh) is now always sourced from the exact same commit as the workflow version the caller pinned → no skew, ever.
• tooling_ref stays as an explicit override for end-to-end branch testing.
• README updated to match.

Why job_workflow_sha

A separately-pinned tooling_ref can drift from the reusable version (too old → missing file; too new → predicate/workflow mismatch). github.job_workflow_sha binds tooling to the reusable's own commit, so a consumer pinning @auto-rebase/stable gets the predicate from whatever commit stable points at — automatically consistent.

Rollout (after this merges)

1. This PR fixes petry-projects/.github's own auto-rebase immediately on merge.
2. Move the auto-rebase/stable channel tag to this commit → deploys the review-ready gate to the 5 on-channel repos (TalkTerm, broodly, google-app-scripts, bmad-bgreat-suite, markets).
3. Caller-bump PRs return the 2 drifted repos (ContentTwin @sha, .github-private @v2) to @auto-rebase/stable.

Note (out of scope)

feature-ideation-reusable.yml carries the same tooling_ref: v1 default pattern — likely the same latent bug. Flagged for a separate fix.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Updated the auto-rebase workflow to use the reusable workflow’s pinned commit when no tooling version is provided, keeping execution consistent with the intended workflow version.
• Documentation
  • Clarified in the reusable workflow documentation how the tooling version default behaves, and when to set it for branch end-to-end testing.
• Chores
  • Adjusted CI GitHub Actions linting to ignore the additional reusable-workflow context warning.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f2eaf7f6-49c6-4723-a0b2-a45f1e44695e

📥 Commits

Reviewing files that changed from the base of the PR and between cc5b42b and f330221.

📒 Files selected for processing (2)

• .github/scripts/auto-rebase/README.md
• .github/workflows/ci.yml

---

📝 Walkthrough

Walkthrough

The reusable auto-rebase workflow now defaults tooling_ref to empty, resolves the tooling checkout to github.job_workflow_sha when unset, updates the README to describe that fallback, and adds an actionlint ignore for the related job_workflow_sha warning.

Changes

Auto-rebase workflow fallback and lint update

Layer / File(s)	Summary
Tooling ref fallback and checkout .github/workflows/auto-rebase-reusable.yml, .github/scripts/auto-rebase/README.md	tooling_ref defaults to an empty string, the tooling checkout uses github.job_workflow_sha when unset, and the README documents that fallback.
Actionlint ignore update .github/workflows/ci.yml	The GitHub Actions lint step adds an ignore for the job_workflow_sha undefined warning and includes a comment explaining it.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• petry-projects/.github#468: Modifies the same tooling_ref workflow input and checkout path in the reusable auto-rebase workflow.

Suggested labels

needs-human-review

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main fix: sourcing the auto-rebase predicate from the reusable workflow’s own commit instead of @v1.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/auto-rebase-tooling-ref-skew

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the documentation in .github/scripts/auto-rebase/README.md to clarify that the tooling_ref input now defaults to empty, resolving to the workflow's own commit rather than v1. The review feedback suggests a minor phrasing improvement to change 'behind PRs' to 'out-of-date PRs' for better readability.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

- ✅ 0 New issues
- ✅ 0 Security Hotspots  
- ✅ No code quality concerns
The PR changes are legitimate documentation and workflow updates related to fixing the `tooling_ref` default (PR references issue #465 in the comments). All CI checks are either successful or still pending—no failures or blockers exist.
**CI Summary:**
- ✅ All code quality checks passed (SonarCloud, CodeQL, ShellCheck, Lint)
- ✅ All security scans passed (gitleaks, AgentShield)
- ✅ CodeRabbit approved
- ⏳ Two dev-lead checks still pending (normal post-approval state)
**Conclusion:** No code changes required. The Quality Gate has already validated this PR, and there are zero issues to fix.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 02b28b504622f048dcce7a45f0d61ee5a2205bc4
Review mode: triage-approved (single reviewer)

Summary

Fixes the auto-rebase reusable workflow so it sources lib/eligibility.sh from the reusable's own commit instead of the mutable @v1 tag (which predates eligibility.sh and made every run fail). Changes the tooling_ref default from 'v1' to '' and resolves the checkout ref to inputs.tooling_ref || github.job_workflow_sha. Scope is small (3 files, +20/-8): the reusable workflow, its README, and a supporting ci.yml actionlint ignore for the job_workflow_sha context property. The fix is security-positive — it pins tooling to an immutable commit SHA rather than a movable tag, and the checkout keeps persist-credentials: false.

Linked issue analysis

No issues are formally linked (closingIssuesReferences is empty). The PR body and commit reference #465 (review-ready gate) and #468 (eligibility.sh introduction) as context for the regression being fixed; these are explanatory, not closing references. Nothing to verify as 'closed' here.

Findings

• Core change (auto-rebase-reusable.yml): defaulting tooling_ref to '' and falling back to github.job_workflow_sha is the correct, idiomatic way to bind a reusable workflow's helper-script checkout to its own pinned commit. Eliminates the version skew that caused the failures. No injection or credential-exposure concerns (job_workflow_sha is GitHub-provided; persist-credentials: false retained).
• ci.yml: the added actionlint ignore ('"job_workflow_sha" is not defined') is a legitimate, scoped supporting change — actionlint 1.7.7's schema omits job_workflow_sha. The Lint check passes with it, confirming correctness. Not mentioned in the PR body's Fix section but clearly in-scope.
• README.md: docs updated to match the new default; also incorporates gemini-code-assist's wording suggestion ('behind PRs' -> 'out-of-date PRs').
• No secrets, no auth/crypto changes, no DB/migration changes.
• Secret scanning MCP tool (run_secret_scanning) was not available in this environment; relied on the passing gitleaks CI check instead. No fabricated result.
• Note (per PR author, out of scope): feature-ideation-reusable.yml reportedly carries the same tooling_ref: v1 default pattern — flagged there for a separate fix; not addressed here, which is acceptable.

CI status

All substantive checks green: Lint, ShellCheck, Lint and bats, CodeQL (Analyze actions), SonarCloud, AgentShield, Agent Security Scan, Secret scan (gitleaks), Dependency audit, and pr-auto-review all SUCCESS. CodeRabbit status SUCCESS and CodeRabbit review APPROVED at head SHA. Dependency-audit language scanners SKIPPED (no matching ecosystems). The only non-success entries are dev-lead dispatch/ci-relay marked CANCELLED — these belong to the agentic review pipeline itself (superseded runs) and are not real failures. reviewDecision is REVIEW_REQUIRED pending the org-leads human gate, which is expected.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #528
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-06-24T23:52:32Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-06-24T23:52:32Z