feat: implement issue #495 — SonarCloud: miscellaneous findings

[don-petry]

User description

Closes #495

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Trigger automatic PR reviews after all repository CI workflows complete

What Changed

• Automatic PR review readiness checks now run when the CI Pipeline, Node.js Tests, Coverage, or Playwright UI Tests workflows finish
• PR status is re-evaluated when these checks succeed, including when a pull request becomes ready for review

Impact

✅ Reviews update after repository CI completes
✅ Fewer stale PR readiness results

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Updated automated pull request review processing to recognize completion across multiple CI, test, coverage, and UI test workflows.
  • Improved CI workflow consistency by adjusting workflow caller wiring formatting for reusable workflows, without changing their behavior.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	cbc6001	Jul 28, 2026 · 18:52	18:52

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1772db9a-28e4-4d47-9704-efc07bbe3dcf

📥 Commits

Reviewing files that changed from the base of the PR and between cbc6001 and 24b4015.

📒 Files selected for processing (3)

• .github/workflows/add-to-project.yml
• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml

---

📝 Walkthrough

Walkthrough

The auto-review workflow now listens for four CI workflow completions. Other reusable workflow caller files receive comment and permission formatting updates without changing their referenced workflows, triggers, or secret inheritance.

Changes

Workflow updates

Layer / File(s)	Summary
Auto-review workflow trigger .github/workflows/pr-auto-review.yml	The trigger includes CI Pipeline, Node.js Tests, Coverage, and Playwright UI Tests; the reusable workflow annotation is reformatted.
Reusable workflow caller formatting .github/workflows/auto-rebase.yml, .github/workflows/add-to-project.yml, .github/workflows/dependabot-automerge.yml	Comment and permission formatting changes preserve reusable workflow references, triggers, permissions, and secrets: inherit behavior.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• petry-projects/google-app-scripts#405: Related SonarCloud handling for GitHub Actions annotations.
• petry-projects/google-app-scripts#481: Related reusable workflow caller updates.

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR introduces behavior changes and uses NOSONAR without an inline false-positive justification, so it misses the issue's no-behavior-change real-fix requirement.	Restore the fix in .github/workflows/pr-auto-review.yml without changing triggers, and remove NOSONAR unless you document a confirmed false positive inline.
Out of Scope Changes check	⚠️ Warning	Three workflows outside issue #495 were edited for comment spacing only, which is unrelated to the linked SonarCloud fix.	Split or remove the unrelated workflow formatting edits so the PR only contains changes needed for issue #495.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is specific and accurately reflects the issue-focused SonarCloud cleanup.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-495-20260728-1849

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Align auto-review triggers with repository CI workflows

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Trigger auto-review after each repository CI workflow completes.
• Remove the obsolete workflow placeholder and normalize YAML formatting.

Diagram

graph TD
  CI["CI Pipeline"] --> Event["Completion Event"] --> Caller["Auto-Review Caller"] --> Gate["Reusable Gate"]
  Node["Node.js Tests"] --> Event
  Coverage["Coverage"] --> Event
  UI["Playwright UI Tests"] --> Event

Loading

High-Level Assessment

Explicitly listing the repository's actual workflow names is the appropriate approach because GitHub Actions requires static names for workflow_run filters. Dynamic workflow discovery is unavailable, while changing the centralized reusable gate would unnecessarily affect other repositories.

Files changed (1) +3 / -3

Other (1) +3 / -3

pr-auto-review.ymlSubscribe auto-review to all repository CI workflows +3/-3

Subscribe auto-review to all repository CI workflows

• Replaces the placeholder CI workflow name with the four repository workflow names that should trigger readiness reevaluation. It also normalizes spacing before the inline Sonar suppression comment.

.github/workflows/pr-auto-review.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 20 rules

1. Required workflows omitted 🐞 Bug ≡ Correctness

Description

The new workflow_run allowlist omits the PR-triggered AgentShield and Dependency audit
workflows, whose jobs are designated as required status checks. Since check_suite does not trigger
for GitHub Actions runs, a PR may remain unprocessed when either omitted workflow is the final
required check to complete.

Code

.github/workflows/pr-auto-review.yml[R32-33]

+    workflows:
+      ['CI Pipeline', 'Node.js Tests', 'Coverage', 'Playwright UI Tests']

Relevance

⭐⭐⭐ High

Prior review required actual readiness workflows; adding omitted required checks is a direct
correctness fix.

PR-#355

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The auto-review workflow states that workflow_run is necessary because check_suite does not
trigger for GitHub Actions, but its new allowlist excludes AgentShield and Dependency audit.
Both excluded workflows run on pull requests, and their documentation identifies their jobs as
required status checks; past PR #355 also established that this allowlist must contain the
repository's actual CI workflow names.

.github/workflows/pr-auto-review.yml[28-35]
.github/workflows/agent-shield.yml[12-26]
.github/workflows/dependency-audit.yml[18-24]
PR-#355

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR auto-review workflow does not listen for completion of all required GitHub Actions workflows. Add the exact top-level workflow names `AgentShield` and `Dependency audit` to `workflow_run.workflows` so readiness is re-evaluated when either completes.

## Issue Context
`check_suite` does not cover GitHub Actions workflow completions. Both omitted workflows run on pull requests and are documented as providing required status checks.

## Fix Focus Areas
- .github/workflows/pr-auto-review.yml[31-34]
- .github/workflows/agent-shield.yml[20-26]
- .github/workflows/dependency-audit.yml[18-24]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[qodo-code-review]

1. Required workflows omitted 🐞 Bug ≡ Correctness

The new workflow_run allowlist omits the PR-triggered AgentShield and Dependency audit
workflows, whose jobs are designated as required status checks. Since check_suite does not trigger
for GitHub Actions runs, a PR may remain unprocessed when either omitted workflow is the final
required check to complete.

Agent Prompt

## Issue description
The PR auto-review workflow does not listen for completion of all required GitHub Actions workflows. Add the exact top-level workflow names `AgentShield` and `Dependency audit` to `workflow_run.workflows` so readiness is re-evaluated when either completes.

## Issue Context
`check_suite` does not cover GitHub Actions workflow completions. Both omitted workflows run on pull requests and are documented as providing required status checks.

## Fix Focus Areas
- .github/workflows/pr-auto-review.yml[31-34]
- .github/workflows/agent-shield.yml[20-26]
- .github/workflows/dependency-audit.yml[18-24]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 24b4015f6e0dbb859fe26dbaf20d96d8880aa74a
Review mode: triage-approved (single reviewer)

Summary

Resolves SonarCloud S1135 by replacing the placeholder workflows: ["CI"] in pr-auto-review.yml with four real workflow names, plus prettier comment-spacing churn in three unrelated thin-caller stubs. The triage tier cleared this as low-risk, but confirmation review found the fix is incomplete (two required-check workflows omitted from the trigger allowlist) and the required CI checks never ran on the head commit, so the PR cannot be auto-approved.

Linked issue analysis

Closes #495 (SonarCloud S1135 — TODO comment in pr-auto-review.yml). The TODO is genuinely resolved with real workflow names and no new NOSONAR suppressions were added (existing ones only had spacing reformatted), so the SonarCloud finding itself is addressed. However, the issue's acceptance criteria require CI green, which is not met on the head commit (see CI status), and the chosen workflow list is incomplete (Finding 1).

Findings

1. [MEDIUM — blocking] workflow_run allowlist omits two required-check workflows. .github/workflows/pr-auto-review.yml now lists CI Pipeline, Node.js Tests, Coverage, and Playwright UI Tests, but omits AgentShield and Dependency audit. Verified at head SHA: both run on pull_request to main and their headers state their job names are required status checks (dependency-audit.yml explicitly says to add dependency-audit / Detect ecosystems to branch protection). Since check_suite does not fire for GitHub Actions runs (per the file's own comment), if either omitted workflow is the last required check to complete, the readiness gate never re-evaluates and the PR sits stale — the exact failure mode this trigger exists to prevent. This confirms Qodo's unresolved 'Action required' finding. Fix: add 'AgentShield', 'Dependency audit' to the list.
2. [MEDIUM — blocking] Required CI checks never ran on the head commit. Head 24b4015 is a chore(ci): apply prettier/eslint auto-fixes commit pushed by github-actions[bot] (GITHUB_TOKEN pushes do not trigger workflows). Check runs on the head SHA show only CodeQL, bots, and agent jobs — no CI Pipeline, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, or Dependency audit. CI cannot be considered green; mergeStateStatus is BLOCKED.
3. [LOW — note] Out-of-scope formatting churn. add-to-project.yml, auto-rebase.yml, dependabot-automerge.yml received comment-spacing-only changes from the repo's autofix job. Functionally harmless (no trigger/uses/permissions changes to the thin caller stubs), but CodeRabbit flagged the scope creep; ideally these would not ride along on an issue-scoped PR.
4. Secret scan: no secrets in the diff; the run_secret_scanning MCP tool was not available in this environment, so only manual + gitleaks/CodeQL coverage applies. dev-lead / dispatch and dev-lead / ci-relay show cancelled runs (agent orchestration, non-blocking).

CI status

Head SHA 24b4015: CodeQL (actions, js/ts, python) ✅, pr-auto-review ✅, CodeRabbit ✅, Graphite ✅. Missing entirely: CI Pipeline, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, Dependency audit — none triggered on the bot-pushed auto-fix commit. Dev-Lead Agent jobs: cancelled/skipped. SonarCloud quality gate passed (on prior commit cbc6001). Merge state: BLOCKED, review decision: REVIEW_REQUIRED. To re-trigger required checks, push an empty commit or close/reopen the PR.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.