ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration)

[don-petry]

Adds the canonical inline # NOSONAR(githubactions:S7637) marker to channel-pinned first-party caller stubs (10 file(s)). Preserves channel pins. Controlled fleet migration (#549/#551), not the weekly audit. hands-off so no agent re-SHA-pins. Legacy sonar-project.properties S7637 entries removed in a verified follow-up.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: aa457b7d-c309-4d4c-988b-038386f631a0

📥 Commits

Reviewing files that changed from the base of the PR and between 5f84eb9 and 97a62de.

📒 Files selected for processing (10)

• .github/workflows/add-to-project.yml
• .github/workflows/agent-shield.yml
• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dependabot-rebase.yml
• .github/workflows/dependency-audit.yml
• .github/workflows/dev-lead.yml
• .github/workflows/pr-auto-review.yml
• .github/workflows/pr-review-mention.yml
• .github/workflows/pr-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/s7637-inline-marker

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-30T20:58:34Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality Gate passed with 0 new issues — no code fixes needed
- dev-lead workflow cancellations are non-blocking CI orchestration events, not code issues
Files changed: 10 workflow files (inline comment additions only)
Skipped (informational): 0
```
The PR is ready from a code quality perspective. The cancelled dev-lead checks may auto-resolve or require investigation by infrastructure/workflow maintainers, but they fall outside the scope of addressing bot code analysis findings.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 97a62dea1283b8ecf76b2fe2b4a9f017a4f2711f
Review mode: triage-approved (single reviewer)

Summary

Adds inline # NOSONAR(githubactions:S7637) markers to 10 first-party caller-stub workflows so SonarCloud stops flagging intentionally channel-pinned references to petry-projects org reusable workflows. Diff is purely additive trailing comments with no behavior change; a follow-up commit fixed prettier formatting. Owner-authored under controlled fleet migration #549/#551.

Linked issue analysis

No closing issue is linked (closingIssuesReferences is empty). The PR body cites tracking issues #549/#551 as context for the controlled fleet migration; no issue is claimed to be closed, so nothing to verify against.

Findings

No blocking findings.

• Every suppressed S7637 reference is a FIRST-PARTY ref to petry-projects/.github or petry-projects/.github-private reusable workflows, pinned by channel/tag (e.g. @pr-review/stable, @v2) by design — promotion is done centrally by moving the tag, not by re-SHA-pinning callers. The NOSONAR marker is the org-sanctioned annotation for this pattern, not the introduction of a supply-chain smell.
• Change is additive comments only; no permissions, secrets, or job logic were modified.
• Marker syntax and placement are consistent across all 10 files; prettier formatting was corrected in the final commit (97a62de).

CI status

Green. Substantive checks all SUCCESS: build-and-test, Node.js Tests, Playwright UI Tests, coverage, CodeQL (actions / javascript-typescript / python), SonarCloud (Quality Gate passed, 0 new issues), Secret scan (gitleaks), dependency-audit, agent-shield. The two CANCELLED checks are dev-lead orchestration relays (dispatch / ci-relay) — non-blocking infra events, not code failures. SKIPPED checks are inapplicable ecosystem audits.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.