chore: sync 4 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

User description

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• dev-lead.yml
• auto-rebase.yml
• dependabot-automerge.yml
• pr-auto-review.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

---

CodeAnt-AI Description

Sync org workflow stubs to the latest standard channels

What Changed

• Updated the shared workflow stubs to point at the current v2-stable channel for auto-rebase and dependabot automerge
• Kept the dev-lead stub on the current stable channel and marked the reusable secret handoff as trusted
• Tightened the inline workflow notes so the stubs match the current org-standard guidance

Impact

✅ Keeps automated rebases on the current supported workflow channel
✅ Keeps Dependabot automerge aligned with the shared standard
✅ Clearer review of trusted reusable workflow usage

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Updated workflow annotations and formatting for automated maintenance jobs.
  • Added a workflow linting exception marker to the development lead automation configuration.
  • Updated the documented auto-rebase channel reference while preserving existing automation behavior.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	2b1fda1	Jul 23, 2026 · 00:53	00:54

_{Updated in place by CodeAnt AI · last 5 reviews}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 151bbf62-5a5a-47c8-9cd8-38687fee4ab5

📥 Commits

Reviewing files that changed from the base of the PR and between 3b60731 and 2b1fda1.

📒 Files selected for processing (3)

• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dev-lead.yml

---

📝 Walkthrough

Walkthrough

GitHub Actions workflow comments, formatting, and NOSONAR annotations were updated. Reusable workflow references, permissions, secret inheritance, and job behavior remain unchanged.

Changes

Workflow maintenance

Layer / File(s)	Summary
Reusable workflow references and annotations .github/workflows/auto-rebase.yml, .github/workflows/dependabot-automerge.yml, .github/workflows/dev-lead.yml	The auto-rebase channel comment and workflow formatting were updated, and NOSONAR annotations were adjusted or added without changing reusable workflow wiring or permissions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: syncing org-standard GitHub Actions workflow stubs from the shared repo.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260723

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

.github/workflows/auto-rebase.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/dependabot-automerge.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

.github/workflows/dev-lead.yml

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Sync org-standard GitHub Actions workflow stubs (v2-stable refs + NOSONAR notes)

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Repoint workflow stubs to org-standard reusable workflow channels (v2-stable where applicable).
• Add/adjust inline NOSONAR annotations for trusted first-party reusables.
• Keep workflows as thin callers; logic remains centralized in reusable workflows.

Diagram

graph TD
  A["Repo workflow stubs"] --> B["auto-rebase.yml"] --> R1["petry-projects/.github\nauto-rebase reusable"]
  A --> C["dependabot-automerge.yml"] --> R2["petry-projects/.github\ndependabot reusable"]
  A --> D["dev-lead.yml"] --> R3["petry-projects/.github-private\ndev-lead reusable"]

  subgraph Legend
    direction LR
    _stub["Workflow stub"] ~~~ _reusable["Reusable workflow"]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin reusable workflows to immutable SHAs

• ➕ Maximizes reproducibility and supply-chain safety (no moving tag)
• ➕ Avoids unexpected behavior changes when the stable channel advances
• ➖ Breaks the org-standard upgrade model; requires frequent repo-by-repo updates
• ➖ Conflicts with documented guidance to use centrally advanced stable channels

2. Vendor/copy reusable workflow logic into this repo

• ➕ Complete local control; no external dependency at runtime
• ➕ Easier to audit changes in a single repo context
• ➖ High maintenance burden; loses central fixes and consistency
• ➖ Increases drift across repositories and duplicates CI logic

Recommendation: Keep the thin-stub approach with centrally advanced *-stable channels as implemented here; it matches the documented org standard and preserves centralized maintenance. The only follow-up worth considering is ensuring all stubs in the PR set are synced (the diff shown contains 3 files), but the overall strategy is appropriate.

Files changed (3) +7 / -7

Other (3) +7 / -7

auto-rebase.ymlAlign auto-rebase stub docs/formatting to v2-stable channel + NOSONAR notes +4/-4

Align auto-rebase stub docs/formatting to v2-stable channel + NOSONAR notes

• Updates the inline documentation to reference the 'auto-rebase/v2-stable' channel and tweaks formatting of the 'uses:'/'secrets:' lines. Adds a NOSONAR annotation on 'secrets: inherit' to mark the reusable as first-party trusted.

.github/workflows/auto-rebase.yml

dependabot-automerge.ymlAdd NOSONAR trusted-reusable annotation for dependabot automerge stub +2/-2

Add NOSONAR trusted-reusable annotation for dependabot automerge stub

• Reformats the 'uses:' line spacing and adds a NOSONAR annotation to 'secrets: inherit' to acknowledge a first-party trusted reusable workflow.

.github/workflows/dependabot-automerge.yml

dev-lead.ymlAnnotate dev-lead stub secrets inheritance as trusted reusable +1/-1

Annotate dev-lead stub secrets inheritance as trusted reusable

• Adds a NOSONAR annotation to 'secrets: inherit' for the dev-lead reusable workflow call, keeping the pinned stable channel intact.

.github/workflows/dev-lead.yml

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #481
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-23T01:24:22Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-23T01:24:22Z

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 20 rules

1. Secrets inherit warning masked 🐞 Bug ⛨ Security

Description

This PR adds NOSONAR(githubactions:S7635) to secrets: inherit lines, suppressing the
static-analysis warning about forwarding all available repo/org secrets into a reusable workflow.
That broad secret grant remains in place (even where only a small set of secrets is documented as
required), but is now easier to miss/forget and harder for tooling to catch as the repo’s secret set
grows.

Code

.github/workflows/dependabot-automerge.yml[39]

+    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable

Relevance

⭐ Low

Similar least-privilege complaint about secrets: inherit was definitely rejected in PR #377;
org-stub NOSONAR pattern merged in #413/#436.

PR-#377
PR-#413
PR-#436

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The caller stubs explicitly use secrets: inherit (forwarding all secrets) while documenting only a
limited required secret set, and this PR adds a Sonar suppression marker to those lines, reducing
automated detection of the broad secret handoff. Other stubs in the same repo demonstrate an
explicit-secret allow-list pattern that avoids inheriting all secrets.

.github/workflows/dependabot-automerge.yml[21-23]
.github/workflows/dependabot-automerge.yml[33-39]
.github/workflows/dependabot-rebase.yml[49-56]
.github/workflows/add-to-project.yml[55-59]
.github/workflows/auto-rebase.yml[21-24]
.github/workflows/auto-rebase.yml[48-54]
.github/workflows/dev-lead.yml[28-30]
.github/workflows/dev-lead.yml[57-74]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Workflow stubs are calling reusable workflows with `secrets: inherit` and (in this PR) explicitly suppressing the corresponding Sonar warning via `NOSONAR(githubactions:S7635)`. This keeps an over-broad secret grant in place while reducing visibility.

### Issue Context
- `secrets: inherit` makes *all* secrets available to the called reusable workflow (not just the ones it needs).
- Some existing stubs in this repo already follow least-privilege by passing only the declared secrets.

### Fix Focus Areas
- Replace `secrets: inherit` with explicit secret mappings where feasible (at least for stubs that document a specific required set of secrets).
- For stubs that truly need many optional secrets, document the rationale clearly and consider still passing an explicit allow-list (even if values may be empty).
- Remove the `NOSONAR(githubactions:S7635)` suppression once least-privilege secret passing is in place.

#### Target locations
- .github/workflows/dependabot-automerge.yml[33-39]
- .github/workflows/auto-rebase.yml[48-54]
- .github/workflows/dev-lead.yml[57-74]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.