fix: restore S7635 NOSONAR markers on secrets: inherit stubs

[don-petry]

User description

Meta-repo quality fix (#879). Adds the inline # NOSONAR(githubactions:S7635) marker to the secrets: inherit line of auto-rebase dependabot-automerge — these had correct pins/self-host refs but were missing the marker (regressed during #857), so SonarCloud S7635 would re-flag them. Pins unchanged.

---

CodeAnt-AI Description

Restore Sonar ignore markers on trusted workflow secret sharing

What Changed

• Restores the Sonar note on two trusted workflow calls so secrets: inherit is no longer flagged again
• Keeps the existing workflow behavior unchanged for auto-rebase and dependabot-automerge

Impact

✅ Fewer false security warnings
✅ Cleaner code quality checks
✅ No change to workflow behavior

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	893a504	Jul 22, 2026 · 18:11	18:11

_{Updated in place by CodeAnt AI · last 5 reviews}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 17 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6deeb005-e789-4df2-a523-7b189d6953a9

📥 Commits

Reviewing files that changed from the base of the PR and between e480059 and 893a504.

📒 Files selected for processing (2)

• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-s7635-markers

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

PR Summary by Qodo

Restore Sonar S7635 NOSONAR on trusted secrets: inherit workflow calls

🐞 Bug fix ⚙️ Configuration changes 🕐 Less than 10 minutes

AI Description

• Re-add inline # NOSONAR(githubactions:S7635) on secrets: inherit for trusted reusable
 workflows.
• Prevent SonarCloud S7635 from re-flagging previously-approved workflow patterns (regressed in
 #857).
• Keep reusable workflow refs/pins unchanged; only restores the suppression markers.

Diagram

graph TD
  A["auto-rebase.yml"] --> B["reusable: auto-rebase"] --> C["secrets: inherit"] --> D["SonarCloud rule S7635"]
  E["dependabot-automerge.yml"] --> F["reusable: dependabot"] --> G["secrets: inherit"] --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Configure SonarCloud to ignore S7635 for specific workflow paths

• ➕ Centralizes the exception (no inline NOSONAR comments).
• ➕ Avoids repeated suppressions across multiple workflow files.
• ➖ May require broader rule suppression than intended (risk of masking real issues).
• ➖ Sonar project configuration changes can be harder to audit/review than inline intent next to the line.

2. Replace `secrets: inherit` with explicit secret mapping

• ➕ Avoids the S7635 finding without suppressions.
• ➕ Makes the secret surface area explicit per workflow.
• ➖ Higher maintenance burden whenever secret requirements change.
• ➖ May be impractical if many secrets are needed or if reusable workflow expects inherited secrets.

Recommendation: Keep the PR’s approach: inline NOSONAR on the specific secrets: inherit lines is the smallest, most targeted fix and preserves the existing trust boundary (first-party reusable workflow refs) without broadening Sonar suppressions or increasing maintenance.

Files changed (2) +2 / -2

Bug fix (2) +2 / -2

auto-rebase.ymlRestore S7635 suppression on trusted 'secrets: inherit' +1/-1

Restore S7635 suppression on trusted 'secrets: inherit'

• Adds an inline '# NOSONAR(githubactions:S7635)' comment to the 'secrets: inherit' line for the auto-rebase reusable workflow call. This prevents SonarCloud from re-flagging the pattern while keeping refs/pins unchanged.

.github/workflows/auto-rebase.yml

dependabot-automerge.ymlRestore S7635 suppression on trusted 'secrets: inherit' +1/-1

Restore S7635 suppression on trusted 'secrets: inherit'

• Adds an inline '# NOSONAR(githubactions:S7635)' comment to the 'secrets: inherit' line for the dependabot automerge reusable workflow call. This restores the intended suppression without changing the referenced reusable workflow.

.github/workflows/dependabot-automerge.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 48 rules

1. auto-rebase.yml changed outside inputs 📘 Rule violation § Compliance

Description

The PR modifies thin caller workflow stubs (.github/workflows/auto-rebase.yml and
.github/workflows/dependabot-automerge.yml) outside the documented with: input-forwarding
mechanism by changing the secrets: inherit line via an added inline marker/comment. This violates
the compliance restriction that thin caller workflow files must be adopted verbatim except for
changes made through documented inputs.

Code

.github/workflows/auto-rebase.yml[54]

+    secrets: inherit  # NOSONAR(githubactions:S7635) first-party trusted reusable

Relevance

⭐ Low

Similar inline NOSONAR on secrets: inherit in workflow stub was merged (PR #1356); stubs are
re-synced canonically (PR #919).

PR-#1356
PR-#919

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 2238422 restricts modifications to thin caller workflow stubs to documented inputs
only. In both workflows, the headers/documentation identify them as thin caller stubs and indicate
customization should occur via with: inputs (with the dependabot stub explicitly stating nothing
may be changed and specifically forbidding changes to secrets: inherit), yet the PR alters the
secrets: inherit line by appending an inline # NOSONAR(...) marker/comment (e.g., `#
NOSONAR(githubactions:S7635)`), demonstrating a non-compliant change outside the permitted
input-forwarding surface.

Rule 2238422: Restrict changes to thin caller workflow files to documented inputs only
.github/workflows/auto-rebase.yml[6-18]
.github/workflows/auto-rebase.yml[25-33]
.github/workflows/auto-rebase.yml[54-54]
.github/workflows/dependabot-automerge.yml[6-15]
.github/workflows/dependabot-automerge.yml[39-39]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The thin caller workflow stubs `.github/workflows/auto-rebase.yml` and `.github/workflows/dependabot-automerge.yml` were modified outside the allowed documented-inputs-only customization by appending an inline marker/comment to the `secrets: inherit` line.

## Issue Context
PR Compliance ID 2238422 requires thin caller workflow stubs to remain verbatim except for customization via documented inputs (typically under `with:`). The dependabot stub header explicitly states nothing may be changed and specifically disallows changing `secrets: inherit`, but the PR modifies that exact line by adding an inline `# NOSONAR(...)` marker/comment.

## Fix Focus Areas
- .github/workflows/auto-rebase.yml[53-54]
- .github/workflows/dependabot-automerge.yml[6-15]
- .github/workflows/dependabot-automerge.yml[39-39]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---