fix: pin pr-review-mention reusable workflow to SHA

[don-petry]

Summary

• Pin .github/workflows/pr-review-mention.yml to the correct SHA d3d768dabb7f28cc63283cdfe48630da53700e50 (latest main commit containing the reusable workflow)

Root cause: The v1 lightweight tag in petry-projects/.github pointed to commit 0cb4bba1 which predates the addition of pr-review-mention-reusable.yml, causing a parse-time error in all caller repos:

error parsing called workflow: failed to fetch workflow: workflow was not found.

The v1 tag has been force-moved to d3d768d and a new v2 tag cut at the same SHA.

Ref: petry-projects/.github#267

Closes #271

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow configuration to use a pinned commit reference instead of a tag-based reference.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: db88c48a-a56e-4912-a83c-b4abeffe92ac

📥 Commits

Reviewing files that changed from the base of the PR and between e9f5bc9 and dd4a2fb.

📒 Files selected for processing (1)

• .github/workflows/pr-review-mention.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/pr-review-mention.yml

---

📝 Walkthrough

Walkthrough

The PR pins the pr-review-mention reusable workflow reference from a floating @v1 tag to a specific commit SHA (d3d768dabb7f28cc63283cdfe48630da53700e50) and adds documentation instructing that future SHA updates should trigger template and fan-out PR updates across caller repositories.

Changes

Workflow Pinning and Documentation

Layer / File(s)	Summary
Pin reusable workflow reference and document process .github/workflows/pr-review-mention.yml	Workflow documentation clarifies that template updates and fan-out PRs across caller repos are required when publishing new reusable workflow SHAs. The pr-review-mention job uses call is pinned from @v1 tag to commit d3d768dabb7f28cc63283cdfe48630da53700e50.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related issues

• Compliance: unpinned-actions-pr-review-mention.yml #271: Compliance: unpinned-actions-pr-review-mention.yml — This PR directly resolves the compliance finding by pinning the reusable workflow reference to a specific commit SHA as required by the action-pinning policy.

Possibly related PRs

• petry-projects/google-app-scripts#134 — Both PRs update workflow caller jobs to invoke reusable workflows via pinned commit SHAs instead of floating tags.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: pinning a reusable workflow reference from @v1 tag to a specific commit SHA.
Linked Issues check	✅ Passed	The PR successfully addresses issue #271 by pinning the pr-review-mention reusable workflow to commit SHA d3d768dabb7f28cc63283cdfe48630da53700e50, satisfying the action-pinning compliance requirement.
Out of Scope Changes check	✅ Passed	All changes are in scope: updating the workflow reference to a pinned SHA and updating inline documentation about the pinning process. No extraneous modifications detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-271-20260511-1237

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Pins the PR review mention thin-caller workflow to a specific commit SHA to comply with the action pinning policy referenced in issue #271.

Changes:

• Update the reusable workflow reference in .github/workflows/pr-review-mention.yml from @v1 to a full commit SHA (@0cb4bba11d7563bf197ad805f12fb8639e4879e4) while retaining the # v1 annotation.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/pr-review-mention.yml (1)

9-10: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Update lines 9-10 to reflect the SHA-based pinning approach.

Lines 9-10 still reference the old tag-based approach (bumping @v1 → @v2), but the new documentation (lines 16-17) and implementation (line 39) use SHA-based pinning. This inconsistency could confuse future maintainers and lead them to revert to tags, violating the organization's action-pinning compliance policy that this PR is meant to satisfy.

📝 Suggested documentation update

-#   • You MAY change: the tag in the `uses:` line when upgrading the reusable
-#     workflow version (e.g. bump `@v1` → `@v2` when petry-projects/.github cuts a new release).
+#   • You MAY change: the SHA in the `uses:` line when upgrading the reusable
+#     workflow version (obtain the new SHA from petry-projects/.github and follow the fanout process below).

Also applies to: 16-17

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-review-mention.yml around lines 9 - 10, Update the
explanatory comments that currently mention tag-based pinning (the guidance
about bumping `@v1` → `@v2` found near the `uses:` explanation) to describe and
require SHA-based pinning instead, matching the documentation later (lines
referencing SHA-based pinning) and the actual `uses:` implementation at line 39;
specifically replace the text that tells maintainers to bump tags with
instructions to pin reusable workflows by full commit SHA and reference the
`uses:` lines as the place to apply that SHA-based pinning so the comments are
consistent with the implementation.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/pr-review-mention.yml:
- Around line 9-10: Update the explanatory comments that currently mention
tag-based pinning (the guidance about bumping `@v1` → `@v2` found near the
`uses:` explanation) to describe and require SHA-based pinning instead, matching
the documentation later (lines referencing SHA-based pinning) and the actual
`uses:` implementation at line 39; specifically replace the text that tells
maintainers to bump tags with instructions to pin reusable workflows by full
commit SHA and reference the `uses:` lines as the place to apply that SHA-based
pinning so the comments are consistent with the implementation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6cc79943-ef6a-495b-9df0-fa29c124b738

📥 Commits

Reviewing files that changed from the base of the PR and between 37ab24c and e9f5bc9.

📒 Files selected for processing (1)

• .github/workflows/pr-review-mention.yml

[don-petry]

@donpetry-bot

[don-petry]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: LOW
Reviewed commit: de8c1272af9558b096e2f251b85a4c152358202a
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

The code change itself is correct and safe — pinning a reusable workflow reference from a mutable @v1 tag to a full commit SHA is a security best practice that satisfies the org's action-pinning policy, and all CI checks pass (CodeQL, SonarCloud, CodeRabbit). However, the PR has an unresolved merge conflict with main (detected 2026-05-19, auto-rebase failed) and still requires a review approval before it can land.

Findings

• MAJOR: Branch has unresolved merge conflicts with main (mergeStateStatus: DIRTY, mergeable: CONFLICTING). Auto-rebase failed on 2026-05-19. Manual resolution and a re-push are required before this PR can be merged.
• MINOR: reviewDecision is REVIEW_REQUIRED — the org-leads team has a pending review request. An approving review is needed in addition to resolving the conflict.
• INFO: Pinning reusable workflow from mutable @v1 tag to full commit SHA d3d768dabb7f28cc63283cdfe48630da53700e50 is the correct security approach; it prevents supply-chain risk from future tag-force-moves (as already happened with @v1 pointing to a pre-workflow commit).
• INFO: All CI checks pass: CodeQL (actions, javascript-typescript, python), SonarCloud Quality Gate (0 new issues, 0 security hotspots), and CodeRabbit pre-merge checks (5/5 passed).
• INFO: CodeRabbit previously flagged stale tag-based guidance in comment lines 9-10; the PR diff addresses this — comments now instruct maintainers to pin by SHA and follow the fanout process, consistent with the implementation.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.