chore: sync 1 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

User description

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• pr-auto-review.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

---

CodeAnt-AI Description

Update automatic PR review triggers to match the repository’s CI workflow

What Changed

• Automatic PR reviews now re-evaluate when the CI workflow completes
• Added guidance to replace CI if the repository uses a different workflow name
• Kept review updates for external checks, review changes, and PR activity

Impact

✅ PR reviews reflect the repository’s CI results
✅ Fewer missed automatic review updates

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Updated automated pull request review triggering to respond only to the CI workflow.
  • Added guidance for updating the workflow name when repository-specific CI configurations change.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	09a54ce	Aug 03, 2026 · 11:34	11:34

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 56 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 4506781c-3049-4bd0-a75c-d1a0c0113509

📥 Commits

Reviewing files that changed from the base of the PR and between 09a54ce and 35df417.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

📝 Walkthrough

Walkthrough

The auto-review workflow now triggers only when the CI workflow completes. A TODO comment documents the repository-specific workflow name. Reusable workflow behavior remains unchanged.

Changes

CI trigger update

Layer / File(s)	Summary
Auto-review workflow trigger and configuration .github/workflows/pr-auto-review.yml	The workflow_run trigger now listens only for CI. A TODO comment was added, and NOSONAR comment spacing was adjusted without changing execution behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• petry-projects/google-app-scripts#481: Modifies the same auto-review workflow configuration.
• petry-projects/google-app-scripts#496: Modifies the workflow_run workflow allowlist in the same file.
• petry-projects/google-app-scripts#507: Modifies the workflow_run.workflows configuration in the same file.

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes syncing an organization-standard workflow stub, which matches the pull request objectives and changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260803

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[qodo-code-review]

PR Summary by Qodo

Sync org-standard pr-auto-review workflow stub

⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Simplify pr-auto-review workflow_run trigger to a single CI workflow name.
• Keep using the org reusable workflow for all pr-auto-review behavior.
• Add TODO to customize the CI workflow name(s) per-repo.

Diagram

graph TD
  pr["PR / checks"] --> stub[".github/workflows/pr-auto-review.yml"] --> reusable["Reusable pr-auto-review"] --> outcome["Auto review actions"]
  stub --> trigger(["workflow_run: CI"]) --> gha["GitHub Actions"]
  reusable --> secrets[("Repo/org secrets")]

  subgraph Legend
    direction LR
    _file["Workflow file"] ~~~ _event(["Event trigger"]) ~~~ _db[("Secrets")]
  end

Loading

High-Level Assessment

This is an org-standard stub sync; deploying the canonical stub verbatim is appropriate. The only repo-specific follow-up is to replace the placeholder workflow name ("CI") with this repository’s actual CI workflow name(s) per the TODO.

Files changed (1) +3 / -10

Other (1) +3 / -10

pr-auto-review.ymlSimplify workflow_run triggers to a single CI workflow name +3/-10

Simplify workflow_run triggers to a single CI workflow name

• Replaces a multi-entry workflow_run workflow list with a single placeholder workflow name ("CI") and adds a TODO to customize it per repository. Keeps delegating behavior to the petry-projects/.github pr-auto-review reusable workflow (no behavioral changes within this repo beyond trigger matching).

.github/workflows/pr-auto-review.yml

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #508
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-08-03T12:05:51Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-08-03T12:05:51Z

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-auto-review.yml:
- Around line 31-33: Update the workflow_run workflows filter to use the actual
CI workflow name, "CI Pipeline", instead of "CI", and revise the adjacent TODO
to reflect that the repository’s CI workflow name is configured.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 09096648-9b92-466c-8b74-6636bac1b273

📥 Commits

Reviewing files that changed from the base of the PR and between 18f442c and 09a54ce.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 20 rules

1. Workflow_run never triggers ✓ Resolved 🐞 Bug ☼ Reliability

Description

pr-auto-review.yml filters workflow_run to only runs from a workflow named "CI", but this
repository’s CI workflows are named "CI Pipeline", "Node.js Tests", "Coverage", "Playwright UI
Tests", "AgentShield", and "Dependency audit". As a result, the PR auto-review readiness gate will
not re-evaluate when those workflows complete, leaving PR readiness stale until another trigger
happens.

Code

.github/workflows/pr-auto-review.yml[R31-34]

+  # TODO: replace "CI" with your repository's CI workflow name(s).
  workflow_run:
-    workflows:
-      [
-        'CI Pipeline',
-        'Node.js Tests',
-        'Coverage',
-        'Playwright UI Tests',
-        'AgentShield',
-        'Dependency audit',
-      ]
+    workflows: ["CI"]
    types: [completed]

Relevance

●●● Strong

Same issue accepted/fixed in pr-auto-review.yml before (PR #355, #496 expanded
workflow_run.workflows).

PR-#355
PR-#496

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The pr-auto-review stub listens for workflow_run completions from a workflow named "CI", but no
workflow in this repo uses that name:. The repo’s actual CI/security workflows have different
names, so the workflow_run trigger will not fire for them (a previously accepted bug pattern in this
exact file).

.github/workflows/pr-auto-review.yml[27-34]
.github/workflows/ci.yml[1-2]
.github/workflows/nodejs-tests.yml[1-2]
.github/workflows/coverage.yml[1-2]
.github/workflows/playwright-tests.yml[1-2]
.github/workflows/agent-shield.yml[18-21]
.github/workflows/dependency-audit.yml[16-21]
PR-#355
PR-#496

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`on.workflow_run.workflows` is set to `["CI"]`, but GitHub matches this against workflow **names** (`name:`), not file names. In this repo, the CI workflows have different `name:` values, so `workflow_run` will not fire when those workflows complete.

### Issue Context
This workflow exists to re-evaluate PR readiness when CI turns green. With the current filter, that re-evaluation won’t happen for the repo’s actual CI/security workflows.

### Fix Focus Areas
- .github/workflows/pr-auto-review.yml[27-34]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-03T12:42:31Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 35df417771264509bb3f5731535e9273ba992f46
Review mode: triage-approved (single reviewer)

Summary

Standards-sync PR deploying the org-standard pr-auto-review.yml stub. Net change: workflow_run trigger list narrowed to the repo's primary CI workflow ('CI Pipeline') plus a comment/whitespace tweak. Bot reviews initially flagged that the synced stub referenced a non-existent 'CI' workflow; the fix commit (35df417) corrected the name to 'CI Pipeline'. All threads resolved, all checks green.

Linked issue analysis

No linked issues. This is an automated standards-sync PR opened by scripts/deploy-standard-workflows.sh; no issue linkage expected.

Findings

No blocking findings.

• Triage assessment confirmed: thin caller stub change, no permission changes, reusable workflow ref unchanged (pinned channel ref, whitespace-only edit on the NOSONAR line).
• Prior bot findings (CodeRabbit, Qodo) that workflow_run filtered on a non-existent 'CI' workflow were resolved by commit 35df417, which uses this repo's actual CI workflow name 'CI Pipeline'. Both review threads are resolved/outdated.
• Informational, non-blocking: the trigger list narrowed from 6 workflows (Node.js Tests, Coverage, Playwright UI Tests, AgentShield, Dependency audit) to only 'CI Pipeline', so completions of those other workflows no longer re-trigger the ready-check via workflow_run. This matches the org-standard stub shape; check_suite and PR-event triggers remain, and the pr-review-sweep backstops missed triggers. If broader trigger coverage is desired, that belongs upstream in petry-projects/.github standards.
• Secret scan: run_secret_scanning MCP tool unavailable in this session; gitleaks CI check passed and the diff contains no secret-like content.

CI status

All required checks green: build-and-test, Node.js Tests, coverage, Playwright UI Tests, CodeQL (actions/js-ts/python), AgentShield, SonarCloud Quality Gate, Secret scan (gitleaks), dependency-audit. Skipped checks are ecosystem-conditional (pnpm/go/cargo/pip audits, dependabot-automerge) — expected.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 35df417771264509bb3f5731535e9273ba992f46
Review mode: triage-approved (single reviewer)

Summary

Verbatim org-standard workflow stub sync (scripts/deploy-standard-workflows.sh) touching only .github/workflows/pr-auto-review.yml (+3/-10). Narrows the workflow_run trigger list to ["CI Pipeline"] per the updated org standard, plus a whitespace-only tweak on the reusable-call line. Verified the repo has an active workflow named 'CI Pipeline' (ci.yml), so the trigger reference is valid; check_suite and PR-activity triggers still cover external checks. The reusable is called via the pinned first-party channel ref with read-only permissions — no security-relevant change. Triage assessment (low-risk) confirmed.

Linked issue analysis

No linked issues — this is an automated standards-sync PR (labeled standards-sync, size:XS), which does not require one.

Findings

• No blocking findings.
• Narrowing workflow_run from six workflows to only 'CI Pipeline' means reviews no longer re-trigger when Node.js Tests, Coverage, Playwright, AgentShield, or Dependency audit complete independently; this is the intent of the org standard (stubs deployed verbatim; behaviour lives in the reusable) and check_suite/PR events still provide coverage. CodeRabbit raised this concern and the thread is resolved.
• Both prior review threads (coderabbit, qodo) are resolved/outdated; latest dev-lead pass at this SHA reported no changes needed.
• Secret-scan MCP tool not available in this run; gitleaks CI check passed and the diff contains no secret material.

CI status

All required checks green at 35df417: build-and-test, Node.js Tests, Playwright UI Tests, Coverage, CodeQL (actions/js-ts/python), AgentShield, Secret scan (gitleaks), SonarCloud quality gate, dependency-audit (npm audit passed; other ecosystems skipped as not present), CodeRabbit and Graphite AI reviews SUCCESS. Skipped jobs are conditional and expected.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.