ci(dev-lead): pin self-host caller to dev-lead/next (ring-0 canary)

[don-petry]

Why

.github-private is ring 0 in the agentic release strategy — the self-host canary that should run a release before it's centrally promoted to dev-lead/stable for consumer repos. But the dev-lead caller was pinned to @dev-lead/stable, so this repo ran the same channel as consumers and never actually exercised new releases first.

Concrete consequence: dev-lead v1.4.0 — which contains the auto-rebase conflict-detection + applied-rate fixes (#812) — is already cut and sitting on dev-lead/next, but dev-lead/stable is still v1.3.0 (the old buggy code). So the rebase path here keeps running the broken version and the #737/#767 applied-rate metric stays stuck at 0%.

Change

Point the dev-lead thin caller's uses: ref and agent_ref from @dev-lead/stable → @dev-lead/next, so self-host runs the canary channel (currently v1.4.0). This makes the auto-rebase fix live in this repo and lets the instrumentation start reflecting corrected behavior, ahead of the eventual central stable promotion.

Verification

• tests/dev-lead/integration/test_dev_lead_stub.sh — passes (validator accepts any first-party channel tag; confirms thin-caller structure + permissions: {} intact).

Notes / out of scope

• This is the ring-0 design as described in docs/initiatives/agentic-release-strategy.md ("Ring 0 = .github-private self-host runs next").
• pr-review-trigger.yml similarly pins @pr-review/stable; I left it unchanged — flipping pr-review to its next channel is a separate call that depends on pr-review/next's own soak state. Happy to do it in a follow-up if you want ring-0 to canary pr-review too.
• Consumer repos still pin @dev-lead/stable, so they're unaffected until a normal central promotion.

🤖 Generated with Claude Code

---

Generated by Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 48 minutes and 40 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e8266c00-6345-45d2-98be-7a5602d791cf

📥 Commits

Reviewing files that changed from the base of the PR and between dec53d0 and 97d3fa0.

📒 Files selected for processing (1)

• .github/workflows/dev-lead.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/github-discussion-735-yvc0iq

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T04:14:39Z.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T04:26:53Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
```
**No action needed.** PR #859 is passing all automated quality gates with zero actionable issues. The SonarCloud comment reports a successful quality gate with no new issues, security hotspots, or code quality concerns. All CI checks are green, and there are no blocking reviews.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 8e3e8db91d428ee7204ac79e5b7093cdeb9c56e0
Review mode: triage-approved (single reviewer)

Summary

Single-file CI config change: flips the dev-lead.yml thin-caller from the @dev-lead/stable channel to @dev-lead/next (both uses: ref and agent_ref), implementing the ring-0 self-host canary design. permissions/secrets structure unchanged; all CI green.

Linked issue analysis

No formal closing issue is linked (closingIssuesReferences empty). The PR is design-driven: it implements the ring-0 canary described in docs/initiatives/agentic-release-strategy.md and picks up dev-lead v1.4.0 (auto-rebase + applied-rate fixes, #812). The rationale is well-documented in the PR body and commit message. No issue acceptance criteria to verify against; triage already cleared this as low-risk config.

Findings

No blocking findings.

• The @dev-lead/next ref is a sanctioned MUTABLE channel tag on a FIRST-PARTY reusable workflow (petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml), explicitly carved out of the SHA-pin standard by AGENTS.md (Release channel tags & the mutable-ref exception). It must NOT be flagged as an unpinned-action smell.
• Channel-tag moves are bounded by the release-channel-tags ruleset; agents running as GITHUB_TOKEN cannot move/delete tags.
• dev-lead.yml is a thin caller stub; per AGENTS.md repo-specific pin adjustments are permitted, and the change touches only the documented pin fields plus its header comment.
• Diff contains no credential-like content; gitleaks CI check passed (MCP secret scan not separately invoked — nothing in the diff resembles a secret).
• Operational note (non-blocking): running next means this repo intentionally soaks a less-promoted channel — that is the intended ring-0 behavior, not a defect.

CI status

All required checks green: CodeQL (actions+python), Secret scan (gitleaks), shellcheck/bats, AgentShield, agent security scan, SonarCloud quality gate passed (0 new issues), and the full Test Dev-Lead Agent suite (stub-structure, caller-permissions, toplevel-permissions, validate-fixtures, etc.). Advisory bots (CodeRabbit/Gemini/Codex) were rate-limited/unsupported but are non-blocking. mergeStateStatus=BLOCKED only due to required org-leads human review (REVIEW_REQUIRED).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

The merge-base changed after approval.

[don-petry]

Dev-Lead — rebase (applied)

Rebase completed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

**CI Check Status:**
- Completed checks: `unit-tests` (success), `dependabot-automerge` (skipped), `CodeRabbit` (success)
- Remaining checks are queued or in_progress — none show failure/timeout/cancelled/action_required
- No Tier 1 blockers (no checks with `conclusion` ∈ {failure, timed_out, cancelled, action_required, stale, startup_failure})
**Review State:**
- One review from `donpetry-bot` with state `DISMISSED` (approved, LOW risk)
- No `CHANGES_REQUESTED` reviews
## Conclusion
**No issues to fix.** The SonarQube comment is reporting that the quality gate passed with zero new issues and no security hotspots. This is a passing status, not a list of actionable findings. There are zero Tier 1 blockers, and no threads from the SonarCloud bot require resolution.
The PR is clean from a quality/security scanning perspective.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality gate passed with 0 new issues: no changes required
- SonarCloud check concluded SUCCESS
Files changed: .github/workflows/dev-lead.yml, .github/workflows/lint.yml, scripts/review-batch.sh, tests/test_engine_unavailable_notice.bats
Skipped (informational): 0
Note: Two dev-lead workflow checks are cancelled but not blocking — all required checks are green per review assessment.
```

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: (none required)
Status: Quality gate passed, no actionable findings
```
The PR is ready for merge from a code quality perspective.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-06-21T08:29:16Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 97d3fa00a169cb80afb13d805c5f173ab3192f1a
Review mode: triage-approved (single reviewer)

Summary

Single-file CI config change (.github/workflows/dev-lead.yml, +6/-5): flips the dev-lead thin-caller from the @dev-lead/stable channel to @dev-lead/next on both the uses: ref and agent_ref, implementing the ring-0 self-host canary so this repo soaks each dev-lead release before central promotion to consumers. Only the pin fields and their explanatory header comment change; on/permissions/secrets structure is untouched.

Linked issue analysis

No formal closing issue is linked (closingIssuesReferences empty). The change is design-driven: it realizes the ring-0 canary described in docs/initiatives/agentic-release-strategy.md and picks up dev-lead v1.4.0 (auto-rebase conflict-detection + applied-rate fixes, #812). Rationale is thoroughly documented in the PR body and commit message; there are no issue acceptance criteria to verify against. Triage already cleared this as low-risk config.

Findings

No blocking findings.

• @dev-lead/next is a sanctioned MUTABLE channel tag on a FIRST-PARTY reusable workflow (petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml). AGENTS.md (Release channel tags & the mutable-ref exception) explicitly carves out stable/next/ring* tags from the SHA-pin standard, so this must NOT be flagged as an unpinned-action smell.
• The dev-lead.yml header explicitly permits modifying this thin caller on PR branches to adjust repo-specific needs; the diff stays within the documented pin fields plus the header comment.
• Channel-tag moves are bounded by the release-channel-tags ruleset; agents running as GITHUB_TOKEN cannot move/delete the next/stable tags, so flipping the caller's pin does not grant new tag-mutation power.
• Diff contains no credential-like content; gitleaks CI check passed. The run_secret_scanning MCP tool was not exposed in this environment (GitHub Secret Protection not surfaced here), so it was not separately invoked — nothing in the single-line ref change resembles a secret.
• Operational note (non-blocking): running next means this repo intentionally soaks a less-promoted channel — that is the intended ring-0 behavior, not a defect.

CI status

All required checks green: CodeQL (actions+python), Secret scan (gitleaks), shellcheck/bats/validate-agent-profiles/gh-aw-compile, AgentShield, Agent Security Scan, Holdout Guard, Test-Deletion Guard, unit-tests, SonarCloud (Quality Gate passed, 0 new issues), and the full Test Dev-Lead Agent suite (stub-structure, caller-permissions, toplevel-permissions, validate-fixtures, auto-rebase-stub, etc.). The two CANCELLED entries (dev-lead / dispatch, dev-lead / ci-relay) are the dev-lead agent's own runs superseded by newer commits, and dependency-audit ecosystem jobs are SKIPPED (no matching ecosystems) — both non-blocking. Advisory bots Codex/Gemini were unavailable (usage limit / unsupported file type) and CodeRabbit was rate-limited — all non-blocking. mergeStateStatus=BLOCKED only reflects the required human review gate (REVIEW_REQUIRED).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.