feat: implement issue #1390 — [Fleet Monitor] petry-projects/.github-private — .github/workflows/pr-auto-review.yml

[don-petry]

User description

Closes #1390

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Skip Dependabot review runs that cannot access required secrets

What Changed

• Dependabot-triggered pull requests now skip the automated review job instead of starting a run that fails during checkout because required secrets are unavailable
• Added regression checks to ensure the Dependabot skip remains in place and the review workflow continues using the expected release channel
• Workflow validation now runs whenever the automated review workflow changes

Impact

✅ Fewer false failures on Dependabot pull requests
✅ Dependabot updates complete without missing-token errors
✅ Protected automated review workflow configuration

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Bug Fixes

  • Prevented automated dependency update events from triggering pull-request review workflows.

• Tests

  • Added validation to ensure the review workflow uses the expected configuration and safely skips dependency update events.
  • Added automated checks that run when the workflow configuration changes.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	5776165	Jul 31, 2026 · 09:35	09:37

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 40 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d8c68e77-b54a-439e-a092-969e91f30d6b

📥 Commits

Reviewing files that changed from the base of the PR and between 5776165 and edbb7b3.

📒 Files selected for processing (4)

• .github/workflows/pr-auto-review.yml
• scripts/seed-repo-template.sh
• tests/dev-lead/integration/test_pr_auto_review_stub.py
• tests/test_seed_repo_template.bats

📝 Walkthrough

Walkthrough

The PR adds a Dependabot exclusion to the reusable review workflow. It wires workflow changes into developer-lead checks and adds a Python regression test for the reusable workflow reference and guard.

Changes

Workflow guard validation

Layer / File(s)	Summary
Add Dependabot guard .github/workflows/pr-auto-review.yml	The review job skips events initiated by dependabot[bot].
Wire and validate the guard .github/workflows/test-dev-lead.yml, tests/dev-lead/integration/test_pr_auto_review_stub.py	The developer-lead workflow runs when the review workflow changes. The validation job and Python script check the reusable workflow reference and Dependabot guard.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• petry-projects/ContentTwin#392 — The issue also modifies and tests .github/workflows/pr-auto-review.yml.

Possibly related PRs

• petry-projects/.github-private#704 — Adds related CI workflow reliability and test infrastructure changes.
• petry-projects/.github-private#986 — Adds regression tests for guards around reusable workflow invocation.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Fleet Monitor issue and the affected workflow.
Linked Issues check	✅ Passed	The changes modify the affected workflow and add regression validation for the reported warning.
Out of Scope Changes check	✅ Passed	The workflow trigger and regression test changes directly support the stated workflow fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-1390-20260731-0928

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Skip Dependabot runs for PR Auto-Review workflow (fix #1390)

🐞 Bug fix 🧪 Tests ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Skip PR Auto-Review job when triggered by dependabot[bot] to avoid missing secret token failures.
• Keep the reusable workflow pin and permissions unchanged while eliminating false CI failures.
• Add an integration stub test to enforce the Dependabot guard and moving-channel ref pin.

Diagram

graph TD
  A["GitHub Actions events"] --> B{"Actor is Dependabot?"} -->|"No"| C["pr-auto-review job"] --> D["pr-auto-review reusable"] --> E["Ready-check checkout"]
  B -->|"Yes"| F["Skip pr-auto-review"] --> H["dependabot-automerge workflow"]
  C --> G[("GH_PAT_WORKFLOWS")]

  subgraph Legend
    direction LR
    _evt["Workflow/job"] ~~~ _dec{"Decision"} ~~~ _db[("Secret")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Add the Dependabot guard in the reusable workflow

• ➕ Centralizes the fix so all repos inherit the behavior automatically
• ➕ Avoids per-repo drift across caller stubs
• ➖ Requires changing the central petry-projects/.github reusable (different repo/process)
• ➖ May be harder to tailor per-repo if some repos want Dependabot behavior

2. Make the reusable fall back to GITHUB_TOKEN for checkout

• ➕ Could allow Dependabot-triggered runs to proceed without custom guards
• ➕ Addresses the root failure mode (missing PAT) at the checkout step
• ➖ May not have sufficient permissions for all reusable steps
• ➖ Riskier behavioral change to shared reusable; needs broader validation

Recommendation: The current approach (job-level if: github.actor != 'dependabot[bot]' in the caller stub) is the best repo-local fix: it avoids altering triggers/permissions/pinning policy while eliminating a known Dependabot-only failure mode. The added stub test appropriately prevents regression (guard removal or ref repin) without needing changes to the central reusable.

Files changed (3) +120 / -0

Bug fix (1) +9 / -0

pr-auto-review.ymlSkip pr-auto-review job for Dependabot actor +9/-0

Skip pr-auto-review job for Dependabot actor

• Adds a job-level 'if' guard to skip running the reusable workflow when the triggering actor is 'dependabot[bot]'. This prevents Dependabot PR runs from failing early due to missing PAT-backed secrets while keeping the reusable ref pin and permissions intact.

.github/workflows/pr-auto-review.yml

Tests (2) +111 / -0

test-dev-lead.ymlWire pr-auto-review stub validation into workflow tests +15/-0

Wire pr-auto-review stub validation into workflow tests

• Includes 'pr-auto-review.yml' in the paths that trigger dev-lead workflow tests. Adds a new 'pr-auto-review-stub' job that installs PyYAML and runs an integration test to validate the Dependabot skip guard and reusable ref pin.

.github/workflows/test-dev-lead.yml

test_pr_auto_review_stub.pyAdd integration test for Dependabot guard and ref pin +96/-0

Add integration test for Dependabot guard and ref pin

• Introduces a YAML-parsing integration test that asserts the caller workflow invokes the expected reusable workflow at '@pr-auto-review/v1-next' and includes an 'if' guard that skips 'dependabot[bot]'. Fails with actionable messages if either invariant is broken.

tests/dev-lead/integration/test_pr_auto_review_stub.py

[gemini-code-assist]

Code Review

This pull request introduces a new integration test script, test_pr_auto_review_stub.py, which validates that the GitHub Actions workflow pr-auto-review.yml is correctly configured. The script parses the workflow YAML to ensure it references the correct reusable workflow version and includes a guard condition to skip execution for Dependabot-triggered events, preventing failures due to missing secrets. There are no review comments provided, and I have no additional feedback on these changes.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/dev-lead/integration/test_pr_auto_review_stub.py`:
- Around line 73-80: Update the guard validation in the test around
DEPENDABOT_ACTOR to require an exclusion condition such as github.actor !=
'dependabot[bot]', rather than accepting any condition containing the actor
text; reject equality or other conditions that allow Dependabot to run.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 49084930-370c-48a2-91d7-f231d8593b48

📥 Commits

Reviewing files that changed from the base of the PR and between 2c89738 and 5776165.

📒 Files selected for processing (3)

• .github/workflows/pr-auto-review.yml
• .github/workflows/test-dev-lead.yml
• tests/dev-lead/integration/test_pr_auto_review_stub.py

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 48 rules

1. Dependabot guard bypass 🐞 Bug ☼ Reliability

Description

pr-auto-review.yml skips only when github.actor != 'dependabot[bot]', so a maintainer re-run (or
other trigger where actor differs from PR author) can execute the job for a Dependabot-authored PR,
defeating the intended skip behavior. This undermines the #1390 fix intent because the guard is not
reliably tied to Dependabot PR authorship across the workflow’s multiple trigger types.

Code

.github/workflows/pr-auto-review.yml[57]

+    if: github.actor != 'dependabot[bot]'

Relevance

●●● Strong

Accepted precedent warns github.actor changes on reruns; guard should key off PR author/login.

PR-#1251

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The workflow is triggered by several PR-related and non-PR-triggered events, but the new guard only
inspects github.actor, which is known to be unreliable for Dependabot PR classification on
re-runs; this can allow the job to execute even when the PR is Dependabot-authored.

.github/workflows/pr-auto-review.yml[27-67]
PR-#1251

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The job-level guard uses `github.actor` which can change on workflow re-runs and is not consistently the PR author for all configured trigger events (`pull_request`, `workflow_run`, `check_suite`, etc.). As a result, Dependabot PRs can still run this job, contradicting the intended “skip Dependabot PRs” behavior.

## Issue Context
This workflow is triggered by multiple event types (not only `pull_request`), so the “Dependabot-ness” should be derived from the PR author in the event payload for the relevant event type, not from `github.actor`.

## Fix Focus Areas
- .github/workflows/pr-auto-review.yml[27-67]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Guard check too permissive ✓ Resolved 🐞 Bug ≡ Correctness

Description

The regression test only verifies that the job if contains the substring dependabot[bot], so a
wrong/inverted condition (e.g., github.actor == 'dependabot[bot]') would still pass. This makes
the test unable to reliably prevent future regressions of the Dependabot skip behavior.

Code

tests/dev-lead/integration/test_pr_auto_review_stub.py[R73-81]

+        guard = job.get("if")
+        if not isinstance(guard, str) or DEPENDABOT_ACTOR not in guard:
+            failures.append(
+                f"  Missing Dependabot guard: job 'if' is {guard!r}\n"
+                f"  Expected an 'if' that skips {DEPENDABOT_ACTOR!r}, e.g.\n"
+                "    if: github.actor != 'dependabot[bot]'\n"
+                "  Reason: Dependabot runs lack GH_PAT_WORKFLOWS, so the reusable's\n"
+                "  checkout fails with 'Input required and not supplied: token' (#1390, #864)."
+            )

Relevance

●●● Strong

Team has accepted hardening tests to assert condition semantics/order, not just token presence.

PR-#453
PR-#451

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The current assertion checks only for token presence, not operator/semantics, so it will accept
incorrect if: expressions that still mention dependabot[bot]. A prior accepted test hardening
change in this repo highlights the need to validate the specific condition rather than a loose
substring match.

tests/dev-lead/integration/test_pr_auto_review_stub.py[73-81]
PR-#493

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The test’s guard assertion is a substring check and does not validate that the condition actually *skips* Dependabot.

## Issue Context
This test is intended as a regression guard for #1390; it should fail if the condition is inverted or otherwise semantically incorrect.

## Fix Focus Areas
- tests/dev-lead/integration/test_pr_auto_review_stub.py[73-81]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. Uncaught YAML parse errors ✓ Resolved 🐞 Bug ☼ Reliability

Description

test_pr_auto_review_stub.py does not catch yaml.YAMLError, so malformed YAML in
.github/workflows/pr-auto-review.yml will crash the test with a traceback instead of emitting a
clear FAIL message. This makes CI failures harder to interpret and inconsistent with other
integration tests in this repo.

Code

tests/dev-lead/integration/test_pr_auto_review_stub.py[R36-41]

+    try:
+        with open(WORKFLOW, encoding="utf-8") as fh:
+            doc = yaml.safe_load(fh)
+    except FileNotFoundError:
+        print(f"FAIL: {WORKFLOW} not found")
+        return 1

Relevance

●●● Strong

Repo already accepted catching yaml.YAMLError for clearer FAIL output when parsing workflow YAML.

PR-#548

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The new test calls yaml.safe_load without a yaml.YAMLError handler; a peer test in the same
suite already demonstrates the intended pattern by catching yaml.YAMLError and returning a
structured failure.

tests/dev-lead/integration/test_pr_auto_review_stub.py[31-46]
tests/dev-lead/integration/test_dependency_audit_stub.py[25-35]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The test reads and parses the workflow YAML but only handles missing files; syntax errors will raise `yaml.YAMLError` and produce an unstructured traceback.

## Issue Context
Other workflow-stub invariant tests in this repo catch `yaml.YAMLError` and print a clear `FAIL:` message.

## Fix Focus Areas
- tests/dev-lead/integration/test_pr_auto_review_stub.py[31-46]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[donpetry-bot]

CI checks on this PR are still running. Once they complete, re-mention @donpetry-bot to trigger a fresh review.

Posted by the donpetry-bot PR-review cascade.

[don-petry]

@coderabbitai resolve

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

Auto-dismissed (#617): coderabbitai[bot] CHANGES_REQUESTED on a superseded commit. The bot re-reviews the new head automatically — a valid concern will return as a fresh review.

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

CI checks on this PR are still running. Once they complete, re-mention @donpetry-bot to trigger a fresh review.

Posted by the donpetry-bot PR-review cascade.

[donpetry-bot]

CI checks on this PR are still running. Once they complete, re-mention @donpetry-bot to trigger a fresh review.

Posted by the donpetry-bot PR-review cascade.

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-31T10:33:11Z

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #1391
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-31T11:27:02Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: edbb7b36fbd1d5aab39c2bd76c35e112325183e6
Review mode: triage-approved (single reviewer)

Summary

Adds a Dependabot skip guard to the pr-auto-review.yml caller stub so Dependabot-triggered runs no longer fail on the unavailable GH_PAT_WORKFLOWS secret (fixes the 20% failure rate flagged in #1390), plus a regression test wired into test-dev-lead.yml and template-drift channel repins in seed-repo-template.sh.

Linked issue analysis

Closes #1390 (Fleet Monitor: pr-auto-review.yml at 20% failure rate). Root cause — Dependabot-triggered runs cannot read org secrets, so the reusable's checkout fails with 'Input required and not supplied: token' — is directly addressed by the job-level guard, mirroring the documented #864 precedent in dev-lead-reusable.yml. Dependabot PRs are handled by dependabot-automerge.yml and never need the review dispatch, so skipping is the correct remediation. The issue is substantively addressed.

Findings

• Guard correctness (verified): github.actor != 'dependabot[bot]' && github.event.pull_request.user.login != 'dependabot[bot]' covers Dependabot-triggered pull_request/workflow_run events (actor check), pull_request_review events and human re-runs on Dependabot PRs (PR-author check). On events with no pull_request payload the second condition resolves empty ≠ 'dependabot[bot]', so non-Dependabot runs are unaffected. Early Qodo/Gemini findings on an inverted guard and permissive test check were fixed in follow-up commits; all 4 review threads are resolved.
• Caller-stub freeze respected: the stub's MUST-NOT list (channel @pr-auto-review/v1-next, trigger event types, job permissions block) is untouched; only an if: guard was added. caller-stub-freeze and stub-structure CI checks pass.
• Regression coverage: new test_pr_auto_review_stub.py asserts both the exact guard expression and the channel pin, and test-dev-lead.yml now runs it on any change to pr-auto-review.yml (job passed on this PR).
• Minor scope note (non-blocking): seed-repo-template.sh repins dependabot-rebase → v2-stable and pr-review-mention → v2-stable — template-drift maintenance beyond the literal issue scope, validated by the template-drift and bats checks, with the bats comment updated in lockstep.
• Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed and no secret-like content appears in the diff.

CI status

All checks on head commit edbb7b3 are green: actionlint, shellcheck, bats, unit-tests, CodeQL (actions + python), gitleaks, SonarCloud quality gate, caller-stub-freeze, stub-structure, template-drift, agent-shield, and the new pr-auto-review-stub job all SUCCESS. Cancelled entries (review/review, dev-lead dispatch/ci-relay, Dismiss) are superseded automation runs with successful counterparts, not code-check failures. CodeRabbit APPROVED; no changes-requested reviews; no unresolved threads.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.