Story (B): channel-ify feature-ideation + pr-auto-review [#604]

[don-petry]

Part of the shim-identity epic #604 — Story B (channel-ify the two off-model shims).

Decision (2026-07-04): all reusable shims use the @<name>/{stable,next,ring#} channel model — no fixed-pin exceptions. Two templates are currently off-model and must be brought on:

• feature-ideation.yml — template pins a frozen @<sha>; compliance-audit.sh centralized[] lists it as fixed v1.
• pr-auto-review.yml — template pins @v2 and is not in centralized[] at all (currently unenforced), though pr-auto-review-reusable.yml exists.

Changes (petry-projects/.github)

• Publish moving channel tags feature-ideation/stable and pr-auto-review/stable via scripts/cut-release.sh (same mechanism as the other <name>/stable channels). This is a release action — include it as a prerequisite step.
• Add both base-names to RING_REUSABLES in scripts/lib/ring-pins.sh so they get per-tier canonical refs.
• Repin standards/workflows/feature-ideation.yml → @feature-ideation/stable and standards/workflows/pr-auto-review.yml → @pr-auto-review/stable.
• scripts/compliance-audit.sh check_centralized_workflow_stubs: change the feature-ideation entry from fixed v1 to the RING sentinel, and add pr-auto-review.yml:pr-auto-review-reusable:RING.
• Tests for both new RING entries.

Acceptance

• feature-ideation and pr-auto-review templates pin @<name>/stable; both validated by the RING branch of the audit; pr-auto-review is now enforced.
• ring_is_ring_reusable feature-ideation / ... pr-auto-review return true.

[don-petry]

Residual scope (verified 2026-07-13)

Story B of the shim-identity epic #604. The canary onboarding prereqs are already done — do NOT redo them:

• ✅ Channel tags exist: feature-ideation/stable (c60e75af), pr-auto-review/stable (376a4fcb).
• ✅ Both registered in standards/canary-rings.json.
• ✅ standards/workflows/feature-ideation.yml already pins @feature-ideation/stable.

What REMAINS (the shim-drift-guard enforcement side that never landed):

1. scripts/lib/ring-pins.sh

Add feature-ideation and pr-auto-review to the RING_REUSABLES array (currently: auto-rebase, dependency-audit, dependabot-automerge, dependabot-rebase, agent-shield, pr-review-mention, dev-lead). After this, ring_is_ring_reusable feature-ideation / ring_is_ring_reusable pr-auto-review return true.

2. scripts/compliance-audit.sh — check_centralized_workflow_stubs centralized[]

• Change "feature-ideation.yml:feature-ideation-reusable:v1:" → "feature-ideation.yml:feature-ideation-reusable:RING".
• Add "pr-auto-review.yml:pr-auto-review-reusable:RING" (currently absent → pr-auto-review is unenforced).

3. Template repin

• standards/workflows/pr-auto-review.yml: @v2 → @pr-auto-review/stable (line ~53). Keep the # NOSONAR(githubactions:S7637) marker.
• feature-ideation.yml is already @feature-ideation/stable — no change.

4. Tests

Extend the check_centralized_workflow_stubs bats (in test/workflows/ / wherever compliance-audit tests live) to cover the two new RING entries — feature-ideation now RING (was v1), pr-auto-review newly enforced as RING.

Acceptance

• RING_REUSABLES includes both; ring_is_ring_reusable returns true for each.
• centralized[] has feature-ideation:...:RING and pr-auto-review:...:RING; audit validates both via the RING branch.
• pr-auto-review.yml template pins @pr-auto-review/stable.
• Tests green; shellcheck clean.

Note on consumers

The .github self-hosts pr-auto-review via ./ and the 6 external consumers were already migrated off @v2 to @pr-auto-review/{ring1,stable} during onboarding — this story is about the template + audit enforcement, not consumer repins.

[don-petry]

Dev-Lead Implementation Plan

Issue: #606 — Story (B): channel-ify feature-ideation + pr-auto-review [#604]

Scope

Bring feature-ideation and pr-auto-review onto the @<name>/{stable,ring…} canary-ring channel model — repin the templates, register both base-names in the ring model, and enforce both via the RING branch of the compliance audit.

Prerequisite (release action, out of this repo's code)

• Publish moving channel tags feature-ideation/stable and pr-auto-review/stable via .github-private's scripts/cut-release.sh (same mechanism as the other <name>/stable channels). Noted here for the release owner — no code in this repo.

Implementation Checklist

• scripts/lib/ring-pins.sh — add feature-ideation and pr-auto-review to RING_REUSABLES (they get per-tier canonical refs; the deploy sweep's is_already_compliant becomes ring-aware for them automatically via the shared lib).
• standards/workflows/pr-auto-review.yml — repin @v2 → @pr-auto-review/stable; update the "bump @v2 → @V3" edit-guidance comment to the moving-channel model.
• standards/workflows/feature-ideation.yml — already pins @feature-ideation/stable (no change needed; verified).
• scripts/compliance-audit.sh check_centralized_workflow_stubs: change feature-ideation.yml:feature-ideation-reusable:v1: → …:RING, and add pr-auto-review.yml:pr-auto-review-reusable:RING.

Tests to Write/Update

• test/scripts/lib/ring-pins.bats — assert ring_is_ring_reusable feature-ideation and … pr-auto-review now return true; assert ring_canonical_ref yields <name>/<tier> for both.
• test/scripts/compliance-audit/centralized-stub-pins.bats — assert stub_pin_acceptable accepts @feature-ideation/stable / @pr-auto-review/stable on a stable-tier repo and rejects the pre-ring @v1/@v2; refresh the stale feature-ideation@v1 comment on the no-legacy-grace case.

Test Command

npx bats test/scripts/lib/ring-pins.bats test/scripts/compliance-audit/centralized-stub-pins.bats (full suite via npx bats -r test tests before finishing), then bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Implementation Complete

Story B — both off-model shims (feature-ideation, pr-auto-review) are now on the @<name>/{stable,ring…} canary-ring channel model and enforced by the RING branch of the compliance audit.

Plan Execution

• Added feature-ideation and pr-auto-review to RING_REUSABLES in scripts/lib/ring-pins.sh → per-tier canonical refs (ring_is_ring_reusable returns true for both; deploy sweep's is_already_compliant is now ring-aware for them automatically via the shared lib).
• Repinned standards/workflows/pr-auto-review.yml @v2 → @pr-auto-review/stable and rewrote its "bump @v2 → @V3" edit-guidance comment to the moving-channel model.
• standards/workflows/feature-ideation.yml — already pinned @feature-ideation/stable (verified; no change needed).
• scripts/compliance-audit.sh check_centralized_workflow_stubs: feature-ideation entry v1 → RING; added pr-auto-review.yml:pr-auto-review-reusable:RING (previously unenforced). Refreshed stale doc-comment examples.
• Fixed a now-stale feature-ideation@v1 non-ring example in scripts/deploy-standard-workflows.sh's is_already_compliant comment.
• Tests updated/added for both new RING entries.

Prerequisite (release action — out of scope for this repo's code)

Publishing the moving channel tags feature-ideation/stable and pr-auto-review/stable via .github-private's scripts/cut-release.sh is a release action performed outside this repo. The ring model's higher-tier grace means the audit does not trip mid-promotion once the tags exist.

Test Results

$ npx bats -r test tests
... 700 tests, 0 failures ...
ok 700 e2e DRY_RUN: covers the whole intended-state surface with no write calls (#970 AC #2/#3)

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck on 21 file(s)...
  [lint] validating .github/CODEOWNERS...
OK: .github/CODEOWNERS
  [lint] all checks passed

Acceptance verified directly:

ring_is_ring_reusable feature-ideation -> true   (canonical stable-repo = feature-ideation/stable)
ring_is_ring_reusable pr-auto-review   -> true   (canonical stable-repo = pr-auto-review/stable)
feature-ideation.yml pins @feature-ideation/stable
pr-auto-review.yml   pins @pr-auto-review/stable

Files Changed

• scripts/lib/ring-pins.sh — feature-ideation, pr-auto-review added to RING_REUSABLES.
• scripts/compliance-audit.sh — feature-ideation → RING; pr-auto-review RING entry added; doc comments refreshed.
• standards/workflows/pr-auto-review.yml — pin @v2 → @pr-auto-review/stable; edit-guidance comment updated.
• scripts/deploy-standard-workflows.sh — comment-only: corrected a stale non-ring example.
• test/scripts/lib/ring-pins.bats — assert both are ring reusables + ring_canonical_ref tier resolution.
• test/scripts/compliance-audit/centralized-stub-pins.bats — RING acceptance/rejection for both stubs; refreshed stale comment.

Notes

• pr-auto-review is not in DEPLOYABLE_WORKFLOWS (nor was it before); the issue scope is enforcement + channel model, which is now in place. No behavior change to the deploy allowlist was requested.
• The sonar-s7637-exemption.bats fixtures that use @v2/@<sha> are generic marker-classification inputs (orthogonal to the pin model) and intentionally left unchanged.