chore(pr-review): pin to pr-review/stable channel (#536 ring-2)

[don-petry]

Replace the deprecated pr-review-reusable.yml@main wrapper with a direct caller of pr-review.yml@pr-review/stable — fixes dropped classic PAT (approvals), mutable @main pin, and missing agent_ref. Adopts the validated markets (#262) / bmad (#290) consumer template. Part of #536 ring-2 fan-out.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 43 minutes and 50 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: cf0bed2a-ccf8-467e-90f4-922ec0ccf720

📥 Commits

Reviewing files that changed from the base of the PR and between ba7a75a and 42e5731.

📒 Files selected for processing (1)

• .github/workflows/pr-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/pin-pr-review-stable

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (Quality Gate)
Root cause: Lint/style

The PR modifies .github/workflows/pr-review.yml to use secrets: inherit when calling the reusable workflow petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable. SonarCloud flags secrets: inherit in reusable workflow calls as a security hotspot (rule S6930/similar) because it forwards all repository secrets — including unintended ones — to the called workflow without explicit scoping. This causes the quality gate to fail when new security hotspots are introduced that exceed the gate threshold.

Suggested fix: Replace secrets: inherit with an explicit secrets: block listing only the secrets the called workflow actually needs (e.g., DON_PETRY_BOT_GH_PAT_CLASSIC: ${{ secrets.DON_PETRY_BOT_GH_PAT_CLASSIC }}), which satisfies the principle of least privilege and resolves the SonarCloud hotspot.

View run logs

[Copilot]

Pull request overview

Updates the repository’s PR review automation to call the org’s PR Review reusable workflow directly, pinned to the pr-review/stable channel, aligning with the newer consumer template and avoiding mutable @main usage.

Changes:

• Switched from the deprecated pr-review-reusable.yml@main wrapper to pr-review.yml@pr-review/stable.
• Expanded trigger set (e.g., check_suite, pull_request_review, repository_dispatch) and updated workflow_dispatch inputs (pr_url, dry_run, force_review).
• Set explicit workflow permissions intended to support PR review/comment actions.

[don-petry]

Added opened to the pull_request trigger types in .github/workflows/pr-review.yml (line 21). The types list is now [opened, ready_for_review, reopened, synchronize], ensuring the workflow fires immediately when a non-draft PR is created — not only on subsequent pushes or draft-to-ready conversions.

[don-petry]

Dev-Lead Fix CI — applied

PR: #377 | SHA: 16e8e88edcffe1b39febd5c582d993ca01d047f8
Fix committed and pushed. Waiting for CI.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (external quality gate)
Root cause: Lint/style

SonarCloud scanned the changes in this PR and the quality gate did not pass. The PR modifies .github/workflows/pr-review.yml, but SonarCloud analyzes the full codebase on each push — the gate may have tripped on pre-existing or newly introduced code smells, duplication, or a coverage/reliability rating threshold. Because SonarCloud reports against the head SHA rather than providing a diff-scoped log here, the exact rule that tripped is only visible on the SonarCloud dashboard.

Suggested fix: Open the SonarCloud project dashboard, filter to the issues introduced at commit 42e5731, and resolve or mark-as-won't-fix the flagged finding that caused the gate to fail.

View run logs

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Lint/style

The PR modifies .github/workflows/pr-review.yml to use secrets: inherit when calling the reusable workflow pr-review.yml@pr-review/stable. SonarCloud flags secrets: inherit as a security hotspot because it unconditionally forwards all repository and organization secrets to the called workflow, widening the blast radius if the callee is ever compromised or modified. This is the most common SonarCloud finding on GitHub Actions workflow changes.

Suggested fix: Replace secrets: inherit with an explicit secrets block listing only the specific secret(s) the called workflow requires (e.g., secrets: { DON_PETRY_BOT_GH_PAT_CLASSIC: ${{ secrets.DON_PETRY_BOT_GH_PAT_CLASSIC }} }), then mark the SonarCloud hotspot as reviewed if the broader secret forwarding is intentional and accepted.

View run logs