From 863b81e5ef3ea2f3b3cb9da9ee6a28cfc57ed57a Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:08 -0500 Subject: [PATCH 01/11] ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) --- .github/workflows/add-to-project.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index 393e18cb..b5b28cdf 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -51,7 +51,7 @@ jobs: add-to-project: permissions: contents: read - uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/stable + uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/stable # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/petry-projects/projects/1 @@ -60,4 +60,4 @@ jobs: # `secrets: inherit` handing the reusable every org secret). secrets: INITIATIVES_APP_ID: ${{ secrets.INITIATIVES_APP_ID }} - INITIATIVES_APP_PRIVATE_KEY: ${{ secrets.INITIATIVES_APP_PRIVATE_KEY }} + INITIATIVES_APP_PRIVATE_KEY: ${{ secrets.INITIATIVES_APP_PRIVATE_KEY }} \ No newline at end of file From d6ffe8ef8514c3d05aec357c1c8db421ea9ea62d Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:09 -0500 Subject: [PATCH 02/11] ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) --- .github/workflows/agent-shield.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 4cf7bb7d..42a73bd8 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -30,4 +30,4 @@ permissions: jobs: agent-shield: - uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/stable + uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/stable # NOSONAR(githubactions:S7637) first-party channel ref \ No newline at end of file From ac0634b9579b5d22a9b987489465051ca1680a7b Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:11 -0500 Subject: [PATCH 03/11] ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) --- .github/workflows/auto-rebase.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml index 12f8eb8d..dde392b1 100644 --- a/.github/workflows/auto-rebase.yml +++ b/.github/workflows/auto-rebase.yml @@ -50,5 +50,5 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # post comments on PRs - uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/stable - secrets: inherit + uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit \ No newline at end of file From 98690aa8c8543a9ce24cccd7eefe8dcd32146c2a Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:14 -0500 Subject: [PATCH 04/11] ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) --- .github/workflows/dependabot-automerge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index c1c5ef2f..8caa29be 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/stable - secrets: inherit + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit \ No newline at end of file From ba0d7849acf4a61f3e6105fea35bb72453049660 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:15 -0500 Subject: [PATCH 05/11] ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) --- .github/workflows/dependabot-rebase.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependabot-rebase.yml b/.github/workflows/dependabot-rebase.yml index c5204099..319c264d 100644 --- a/.github/workflows/dependabot-rebase.yml +++ b/.github/workflows/dependabot-rebase.yml @@ -50,7 +50,7 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # re-approve PRs after branch update - uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/stable + uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: APP_ID: ${{ secrets.APP_ID }} - APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} \ No newline at end of file From 7367ae532b716f0e91dfe173559028c180ba015b Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:16 -0500 Subject: [PATCH 06/11] ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) --- .github/workflows/dependency-audit.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index c1af742e..a4db5834 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -30,4 +30,4 @@ permissions: jobs: dependency-audit: - uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/stable + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/stable # NOSONAR(githubactions:S7637) first-party channel ref \ No newline at end of file From 76d115956e59d55a2e63613d8cf1e2fd5c39cd5d Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:17 -0500 Subject: [PATCH 07/11] ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) --- .github/workflows/dev-lead.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index 107d265b..deefa7dc 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -48,7 +48,7 @@ jobs: # dependency). Promotion is done by moving the dev-lead/stable tag centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See ci-standards.md#dev-lead-agent. - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable # NOSONAR(githubactions:S7637) first-party channel ref with: agent_ref: dev-lead/stable secrets: inherit @@ -58,4 +58,4 @@ jobs: issues: write actions: read checks: read - statuses: read + statuses: read \ No newline at end of file From 2ef6aaa864d13d5fcf7f93ad63cfde07cbaaf547 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:20 -0500 Subject: [PATCH 08/11] ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) --- .github/workflows/pr-auto-review.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index 8f125aa0..ddb586ee 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -56,6 +56,6 @@ jobs: pull-requests: read checks: read actions: read - uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@v2 + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@v2 # NOSONAR(githubactions:S7637) first-party channel ref secrets: - GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }} + GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }} \ No newline at end of file From eb13b9a7c843c03ffd89d78ca12ae6f6c0c27c06 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:21 -0500 Subject: [PATCH 09/11] ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) --- .github/workflows/pr-review-mention.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-review-mention.yml b/.github/workflows/pr-review-mention.yml index d9a27b28..fb0a1628 100644 --- a/.github/workflows/pr-review-mention.yml +++ b/.github/workflows/pr-review-mention.yml @@ -37,5 +37,5 @@ jobs: pr-review-mention: permissions: pull-requests: write - uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/stable - secrets: inherit + uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit \ No newline at end of file From d0b43b86fb87916bbfe7f6f335e5139aae300159 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Tue, 30 Jun 2026 14:51:22 -0500 Subject: [PATCH 10/11] ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) --- .github/workflows/pr-review.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index cf5345dd..64d669fb 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -42,7 +42,7 @@ permissions: {} jobs: review: - uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable + uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable # NOSONAR(githubactions:S7637) first-party channel ref permissions: contents: read pull-requests: write @@ -52,4 +52,4 @@ jobs: pr_url: ${{ inputs.pr_url || '' }} dry_run: ${{ inputs.dry_run || '' }} force_review: ${{ inputs.force_review || '' }} - secrets: inherit + secrets: inherit \ No newline at end of file From 97a62dea1283b8ecf76b2fe2b4a9f017a4f2711f Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 30 Jun 2026 19:55:53 +0000 Subject: [PATCH 11/11] ci: fix prettier formatting on NOSONAR(S7637) markers in workflows The NOSONAR markers added in previous commits had incorrect spacing (two spaces before the comment marker) and missing newlines at EOF. Prettier now formats these files correctly with single space before comments and proper line endings. Co-Authored-By: Claude Haiku 4.5 --- .github/workflows/add-to-project.yml | 4 ++-- .github/workflows/agent-shield.yml | 2 +- .github/workflows/auto-rebase.yml | 4 ++-- .github/workflows/dependabot-automerge.yml | 4 ++-- .github/workflows/dependabot-rebase.yml | 4 ++-- .github/workflows/dependency-audit.yml | 2 +- .github/workflows/dev-lead.yml | 4 ++-- .github/workflows/pr-auto-review.yml | 4 ++-- .github/workflows/pr-review-mention.yml | 4 ++-- .github/workflows/pr-review.yml | 4 ++-- 10 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index b5b28cdf..b737f3ca 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -51,7 +51,7 @@ jobs: add-to-project: permissions: contents: read - uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/stable # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/petry-projects/projects/1 @@ -60,4 +60,4 @@ jobs: # `secrets: inherit` handing the reusable every org secret). secrets: INITIATIVES_APP_ID: ${{ secrets.INITIATIVES_APP_ID }} - INITIATIVES_APP_PRIVATE_KEY: ${{ secrets.INITIATIVES_APP_PRIVATE_KEY }} \ No newline at end of file + INITIATIVES_APP_PRIVATE_KEY: ${{ secrets.INITIATIVES_APP_PRIVATE_KEY }} diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 42a73bd8..097a8071 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -30,4 +30,4 @@ permissions: jobs: agent-shield: - uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/stable # NOSONAR(githubactions:S7637) first-party channel ref \ No newline at end of file + uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/stable # NOSONAR(githubactions:S7637) first-party channel ref diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml index dde392b1..65b06403 100644 --- a/.github/workflows/auto-rebase.yml +++ b/.github/workflows/auto-rebase.yml @@ -50,5 +50,5 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # post comments on PRs - uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit \ No newline at end of file + uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index 8caa29be..fb3985b3 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit \ No newline at end of file + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit diff --git a/.github/workflows/dependabot-rebase.yml b/.github/workflows/dependabot-rebase.yml index 319c264d..42214b4c 100644 --- a/.github/workflows/dependabot-rebase.yml +++ b/.github/workflows/dependabot-rebase.yml @@ -50,7 +50,7 @@ jobs: permissions: contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # re-approve PRs after branch update - uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@dependabot-rebase/stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: APP_ID: ${{ secrets.APP_ID }} - APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} \ No newline at end of file + APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }} diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index a4db5834..5224176b 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -30,4 +30,4 @@ permissions: jobs: dependency-audit: - uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/stable # NOSONAR(githubactions:S7637) first-party channel ref \ No newline at end of file + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/stable # NOSONAR(githubactions:S7637) first-party channel ref diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index deefa7dc..45fe4704 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -48,7 +48,7 @@ jobs: # dependency). Promotion is done by moving the dev-lead/stable tag centrally; this # caller is never edited on release. agent_ref threads the same channel into # dev-lead's own scripts/prompts checkout. See ci-standards.md#dev-lead-agent. - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable # NOSONAR(githubactions:S7637) first-party channel ref with: agent_ref: dev-lead/stable secrets: inherit @@ -58,4 +58,4 @@ jobs: issues: write actions: read checks: read - statuses: read \ No newline at end of file + statuses: read diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index ddb586ee..3b0685f9 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -56,6 +56,6 @@ jobs: pull-requests: read checks: read actions: read - uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@v2 # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@v2 # NOSONAR(githubactions:S7637) first-party channel ref secrets: - GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }} \ No newline at end of file + GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }} diff --git a/.github/workflows/pr-review-mention.yml b/.github/workflows/pr-review-mention.yml index fb0a1628..dca2b37d 100644 --- a/.github/workflows/pr-review-mention.yml +++ b/.github/workflows/pr-review-mention.yml @@ -37,5 +37,5 @@ jobs: pr-review-mention: permissions: pull-requests: write - uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit \ No newline at end of file + uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml index 64d669fb..815f6a0c 100644 --- a/.github/workflows/pr-review.yml +++ b/.github/workflows/pr-review.yml @@ -42,7 +42,7 @@ permissions: {} jobs: review: - uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable # NOSONAR(githubactions:S7637) first-party channel ref permissions: contents: read pull-requests: write @@ -52,4 +52,4 @@ jobs: pr_url: ${{ inputs.pr_url || '' }} dry_run: ${{ inputs.dry_run || '' }} force_review: ${{ inputs.force_review || '' }} - secrets: inherit \ No newline at end of file + secrets: inherit