chore(deps): bump petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml from 75db5eca194691d128457ee220e80e07b1d23db8 to ce51626d72330aacbc138d65f00bd0a533258fdd

[dependabot]

Bumps petry-projects/.github-private/.github/workflows/ci-failure-analyst-reusable.yml from 75db5eca194691d128457ee220e80e07b1d23db8 to ce51626d72330aacbc138d65f00bd0a533258fdd.

Commits

• ce51626 fix(dev-lead): never SHA-pin first-party channel refs when applying feedback ...
• 7db4404 feat(release): codify release-channel-tags ruleset + apply-rulesets.sh (#868)...
• 8714816 feat: implement issue #881 — pr-review engine: COPILOT_API_MODEL unbound va...
• 7a815da feat: implement issue #739 — [Phase 2] Validate the reduction and record the ...
• f362afe feat: implement issue #883 — [Phase 1] Parameterize initiative-driver.yml on ...
• 195a24e docs(release): document live dev-lead next/ring channels + staged-rollout run...
• e634fdb feat(pr-review): add REVIEW_MCP_DEBUG knob to surface the MCP handshake (#892)
• 42913ab feat: implement issue #843 — [Phase 2] Add the LSP finding-verification step ...
• b31e518 ci(dev-lead): pin self-host caller to dev-lead/next (ring-0 canary) (#859)
• dec53d0 feat: implement issue #842 — [Phase 2] Wire candidate LSP-MCP server(s) into ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- No code issues reported
Files changed: None (no fixes needed)
Skipped: 0
Status: ✓ Quality gate passed, all checks passing, no action required
```
The PR is in good shape and ready to proceed. The in-progress checks (`autofix` and `review/review`) will complete as part of the normal CI workflow.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 5867cc27a5a5304665b6ad8600ef39d467b0a4e2
Review mode: triage-approved (single reviewer)

Summary

Dependabot bump of a SHA-pinned first-party reusable workflow (ci-failure-analyst-reusable.yml) from 75db5eca to ce51626d. Single-line change to .github/workflows/ci-failure-analyst.yml; full 40-char SHA pin maintained (secure pattern), tracking the .github-private main branch.

Linked issue analysis

No linked issue — routine automated dependency PR (expected for Dependabot).

Findings

• The new SHA ce51626d72330aacbc138d65f00bd0a533258fdd was verified via the GitHub API to be a legitimate commit on petry-projects/.github-private (authored by Don Petry, 2026-06-21), matching the top commit in Dependabot's commit list.
• Pin remains a full 40-char commit SHA (not a tag/branch) — the secure pinning pattern is preserved.
• Diff contains only the SHA change; no secrets, no logic, no permission/trigger changes.
• MCP secret-scanning tool not exposed in this run; relied on the gitleaks CI check (SUCCESS) — no secrets detected.
• No GitHub Actions security smells introduced.

CI status

All checks green: AgentShield, build-and-test, CodeQL (actions/js-ts/python), coverage, SonarCloud (Quality Gate passed — 0 new issues), gitleaks secret scan, dependency-audit, Node.js/Playwright tests. Two automerge approvals present; mergeStateStatus BLOCKED only on the required org-leads review this review satisfies.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Quality Gate
Root cause: Lint/style

SonarCloud flagged 22 new Security Hotspots on this branch, causing the Quality Gate to fail. Security Hotspots are code patterns identified by static analysis that require manual review to confirm whether they represent real vulnerabilities. This PR bumps the ci-failure-analyst-reusable.yml reusable workflow SHA, and the new workflow commits may have introduced code patterns that SonarCloud flags as hotspots.

Suggested fix: Open the SonarCloud Security Hotspots view, review each of the 22 hotspots, and mark them as "Safe" if they are false positives, or refactor the flagged patterns to eliminate the hotspot.

View run logs