chore: sync 1 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• initiative-driver.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 1 minute

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: de29c74f-7fd9-4954-bbcf-3a19846ed44b

📥 Commits

Reviewing files that changed from the base of the PR and between 027ba0b and c838351.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• .github/workflows/initiative-driver.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260721

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[Copilot]

Pull request overview

This PR syncs the org-standard GitHub Actions caller stub for the “initiative driver” workflow, keeping this repository aligned with the centralized initiative automation in petry-projects/.github-private.

Changes:

• Update the scheduled cron entry quoting in the workflow stub.
• Allow GH_TOKEN to be sourced from GH_PAT_DON_PETRY with a fallback to GH_PAT_WORKFLOWS for dispatching the central workflow.

Comments suppressed due to low confidence (1)

.github/workflows/initiative-driver.yml:80

• The PAT guard now allows either GH_PAT_DON_PETRY or GH_PAT_WORKFLOWS, but the emitted error still says only GH_PAT_WORKFLOWS is required. This is misleading when troubleshooting missing secrets.

          GH_TOKEN: ${{ secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS }}
        run: |
          if [ -z "${GH_TOKEN}" ]; then
            echo "::error::GH_PAT_WORKFLOWS is required — a workflow_dispatch fired with GITHUB_TOKEN never starts a run."
            exit 1

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Fixed the misleading error message in . The error now correctly indicates that either GH_PAT_DON_PETRY or GH_PAT_WORKFLOWS is required, which matches the actual token fallback logic on line 76.

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: f4627ce893cd125421d1966eae2df931f1c93537
Cascade: triage → audit (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)

Summary

Standards-sync PR verified byte-for-byte against the upstream template in petry-projects/.github (standards/workflows/initiative-driver.yml): the GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS fallback that triggered escalation exists verbatim in the org standard and was NOT injected in this PR, ruling out the credential-tampering hypothesis. The only divergence is a benign one-line error-message improvement (commit c838351), and the fast-uri 3.1.4 dev-dependency bump's integrity hash matches the npm registry exactly. All status checks (CodeQL, gitleaks, AgentShield, dependency-audit, tests) are now SUCCESS; the personal-PAT-primary pattern remains a real least-privilege concern but lives in the upstream standard and cannot be remediated by blocking this faithful sync.

Findings

• MINOR: GH_TOKEN prefers secrets.GH_PAT_DON_PETRY (personal PAT) over the shared secrets.GH_PAT_WORKFLOWS. Verified this fallback is copied verbatim from the org standard petry-projects/.github standards/workflows/initiative-driver.yml, so it is an intentional org-wide pattern, not an injection in this PR. Advisory: remediate upstream — a personal PAT ties org automation to one individual (offboarding/rotation risk, run attribution) versus a dedicated fine-grained workflow PAT or GitHub App installation token scoped to actions:write on petry-projects/.github-private. (.github/workflows/initiative-driver.yml:76)
• MINOR: The synced stub now diverges from the upstream template by one line: commit c838351 improved the guard error message ('Either GH_PAT_DON_PETRY or GH_PAT_WORKFLOWS is required') but the upstream standard still has the stale message. The next standards-sync run will flag or revert this drift. Upstream the fix to petry-projects/.github standards/workflows/initiative-driver.yml. (.github/workflows/initiative-driver.yml:79)
• MINOR: Commit f4627ce (dev-lead bot) bumped package-lock.json fast-uri 3.1.2 -> 3.1.4 inside a PR whose body claims workflow stubs are 'deployed verbatim' — unrelated scope creep by automation. The bump itself is safe: integrity sha512-8Jnbk... matches the npm registry record for fast-uri@3.1.4 (official Fastify package, published 2026-07-19, dev-only transitive), and npm audit passed. (package-lock.json:3926)
• INFO: Workflow security posture is sound: permissions restricted to contents: read, no pull_request_target, no untrusted expression interpolation into run blocks (only server-controlled github.repository), label filter only in the if: condition, concurrency guard present, 5-minute timeout. (.github/workflows/initiative-driver.yml)
• INFO: All status checks are SUCCESS at audit time (CodeQL x3, build-and-test, coverage, Node.js Tests, Playwright, AgentShield, gitleaks, dependency-audit, SonarCloud quality gate). The deep review's 'CI not green' finding reflected an in-progress snapshot and is now stale. mergeStateStatus BLOCKED solely reflects the pending required review.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: c8383517e47f4534f259210370ce7f734b0045b9
Review mode: triage-approved (single reviewer)

Summary

Triage-approved confirmation review of a standards-sync PR. Independently re-verified: (1) the GH_PAT_DON_PETRY || GH_PAT_WORKFLOWS token fallback and double-quoted cron exist verbatim in the upstream org standard petry-projects/.github standards/workflows/initiative-driver.yml — not injected in this PR; (2) the fast-uri 3.1.4 lockfile bump's integrity hash matches the npm registry exactly (dev-only transitive dep). The only upstream divergence is a one-line error-message correction (commit c838351) that makes the guard message match the actual fallback logic. All CI checks green (CodeQL x3, gitleaks, AgentShield, dependency-audit/npm audit, tests, SonarCloud); the only in-progress check is this review run itself. Prior full cascade approved this same SHA at MEDIUM risk. Confirms the triage assessment.

Linked issue analysis

No linked issues — expected for an automated standards-sync PR opened by scripts/deploy-standard-workflows.sh. The PR body accurately describes the change.

Findings

• MINOR (advisory, upstream): GH_TOKEN prefers a personal PAT (GH_PAT_DON_PETRY) over the shared GH_PAT_WORKFLOWS. Verified verbatim in the org standard, so it is the sanctioned pattern, not an injection — but it ties org automation to one individual (offboarding/rotation risk). Remediate upstream in petry-projects/.github, not by blocking this sync. (.github/workflows/initiative-driver.yml:76)
• MINOR (advisory, upstream): The corrected guard error message ("Either GH_PAT_DON_PETRY or GH_PAT_WORKFLOWS is required") is a genuine improvement but now diverges by one line from the upstream template, which still has the stale message. The next standards-sync run may revert it — upstream the fix. (.github/workflows/initiative-driver.yml:79)
• INFO: fast-uri 3.1.2 → 3.1.4 lockfile bump verified: integrity sha512-8JnbkQ4j... matches the npm registry record for the official package; dev-only transitive; npm audit passed.
• INFO: Workflow security posture sound: permissions: contents: read, no pull_request_target, no untrusted expression interpolation, concurrency guard, 5-minute timeout.
• NOTE: run_secret_scanning MCP tool unavailable in this environment; gitleaks CI check passed (SUCCESS).

CI status

All completed checks SUCCESS: CodeQL (actions, javascript-typescript, python), build-and-test, coverage, Node.js Tests, Playwright UI Tests, AgentShield, gitleaks secret scan, dependency-audit (npm audit), SonarCloud quality gate, CodeRabbit. Non-applicable ecosystem audits SKIPPED. Only in-progress check is this review workflow run itself.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.