fix(ci): sync dependabot-rebase.yml with canonical org stub

[don-petry]

Summary

• Replaces the outdated dependabot-rebase.yml stub with the canonical version from petry-projects/.github/standards/workflows/dependabot-rebase.yml
• Adds missing schedule trigger (cron: '0 */4 * * *') as a safety net when no pushes to main occur, keeping the Dependabot PR queue flushed
• Updates AGENTS comment to document the schedule trigger
• Updates APP_ID comment to include contents:write permission note

The uses: SHA (b51e2edf830ea085be0277bcf3174c7b3ec8f958 # v1) is unchanged — it already matches the org standard.

Closes #132

Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Chores
  • Enhanced Dependabot automation with scheduled runs every 4 hours as a safety net for dependency updates
  • Added manual trigger capability for processing dependency update requests on-demand

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 11 minutes and 59 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4e3a4c96-0844-486a-85ba-c6931f54bb03

📥 Commits

Reviewing files that changed from the base of the PR and between 36d3e57 and 3d4b844.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

📝 Walkthrough

Walkthrough

The Dependabot automation workflow gains time-based and manual triggering capabilities. A scheduled cron trigger (every 4 hours) acts as a safety net when pushes are infrequent, and a manual trigger enables on-demand queue flushing. Documentation comments clarify the trigger roles and GitHub App permission requirements.

Changes

Dependabot Workflow Triggers and Permissions

Layer / File(s)	Summary
Workflow Trigger Configuration .github/workflows/dependabot-rebase.yml	Added schedule (cron: every 4 hours) and workflow_dispatch manual trigger alongside existing push to main event.
Trigger Documentation and Guidance .github/workflows/dependabot-rebase.yml	Updated header guidance comments to explain the safety-net role of the scheduled trigger when push activity is infrequent.
GitHub App Permissions Documentation .github/workflows/dependabot-rebase.yml	Updated APP_ID documentation comment to specify required GitHub App permissions: contents:write and pull-requests:write.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• #132: Compliance issue flags that the workflow is not pinned to @v1 and should use the canonical stub from petry-projects/.github—the PR modifies the same workflow file but does not address the pinning compliance finding.

Possibly related PRs

• petry-projects/ContentTwin#52: Modifies the same workflow file and addresses its structure, potentially in coordination with trigger and documentation changes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: syncing the dependabot-rebase.yml workflow file with the canonical organization stub to bring the repository into compliance.
Linked Issues check	✅ Passed	The pull request successfully addresses issue #132 by replacing the outdated workflow with the canonical stub, pinning the reusable workflow to @v1, and adding the schedule trigger as specified in the compliance requirements.
Out of Scope Changes check	✅ Passed	All changes in the pull request are directly scoped to syncing the dependabot-rebase.yml file with the canonical organization stub; no unrelated modifications are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-132-20260508-1418

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@petry-projects/org-leads — this PR is ready for review and merge.

Summary: Syncs .github/workflows/dependabot-rebase.yml with the canonical org stub. The key functional change adds the missing schedule trigger (0 */4 * * *) as a safety net. The reusable workflow SHA is unchanged.

Closes #132

[Copilot]

Pull request overview

Updates the repository’s dependabot-rebase.yml thin-caller workflow stub to align with the org canonical template by adding a scheduled trigger and refining the embedded guidance comments.

Changes:

• Added a schedule trigger (every 4 hours) as a fallback when push to main does not occur.
• Updated AGENTS guidance to include the new trigger and clarify intent.
• Updated the APP_ID comment to note required GitHub App permissions include contents:write.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Auto-rebase blocked — the base branch contains .github/workflows/ changes that require the workflows permission to merge into this branch, but the auto-rebase workflow's token does not have that permission.

Please rebase this branch manually:

git fetch origin
git rebase origin/main
git push --force-with-lease

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 7a4967a220b6b2abd4800f4e065d28823addbe97
Review mode: triage-approved (single reviewer)

Summary

Single-line change pinning actions/checkout@v5 to its commit SHA (93cb6efe18208431cddfb8368fd83d5badbf9bfd) in .github/workflows/pr-review.yml. This is a standard security best practice that prevents supply chain attacks via tag mutation.

Linked issue analysis

Closes #51 — a compliance finding (action-pinning / error severity) from the weekly audit flagging actions/checkout@v5 as unpinned. The fix directly addresses the finding by pinning to the exact SHA while retaining a # v5 comment for readability.

Findings

• ✅ SHA 93cb6efe18208431cddfb8368fd83d5badbf9bfd verified as the correct commit for actions/checkout tag v5
• ✅ Version comment (# v5) retained for maintainability
• ✅ No functional changes to the workflow logic
• ✅ No security concerns

CI status

Check	Status
Claude Code	✅ SUCCESS
CodeQL (actions)	✅ SUCCESS
CodeQL (javascript-typescript)	✅ SUCCESS
CodeQL (python)	✅ SUCCESS
CodeRabbit	✅ SUCCESS

---

Reviewed automatically by the PR-review agent (single-reviewer). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: dd027e55048b2f66c989c4c23bc2f77951173054
Review mode: triage-approved (single reviewer)

Summary

Confirms triage's low-risk classification. This is a security-improving, config-only PR: it adds a SHA-pinned gitleaks secret-scan job, a comprehensive .gitignore secrets baseline (391 lines, verbatim from the petry-projects org standard), and registers gitleaks as a required status check in the code-quality ruleset. The prior audit (cycle 1 on SHA 4ff2f9c) approved the same content set with MEDIUM risk; the new HEAD is a merge commit bringing main forward, with no further substantive changes.

Linked issue analysis

Closes #68 (push-protection compliance). The PR substantively addresses the three code-side compliance gaps (secret_scan_ci_job_present, gitignore_secrets_block, ruleset required-check coverage). The remaining security_and_analysis_unavailable finding is correctly scoped out of code: it requires an admin API call documented in the PR body.

Findings

Info

• [info] .github/workflows/ci.yml:54 — continue-on-error: true on the gitleaks job is still present from the original bootstrapping window. The CI run on this HEAD shows the gitleaks job passed (Secret scan (gitleaks): SUCCESS), so the GITLEAKS_LICENSE org secret has clearly been provisioned and the flag is now dormant in practice. It should be removed in a follow-up so the required status check actually enforces; this is also the open CodeRabbit comment. Not a blocker — current state introduces no security gap because the underlying check succeeds.
• [info] Action SHA pins remain valid (verified in prior audit): actions/checkout@de0fac2… = v6.0.2, gitleaks/gitleaks-action@ff98106… = v2.3.9.
• [info] Workflow permissions are minimal (contents: read, security-events: write); triggers are push / pull_request (no pull_request_target); no expression-injection vectors. Org-secret exposure is limited to GITLEAKS_LICENSE on the gitleaks step.
• [info] .gitignore structure correctly orders negations after their broad patterns; encrypted variants (*.enc.yaml, *.sops.yaml, etc.) are explicitly re-allowed; no over-broad directory ignores.

CI status

All required checks green on HEAD dd027e55: Lint ✓, Format ✓, Secret scan (gitleaks) ✓, SonarCloud ✓ (Quality Gate passed, 0 new issues / 0 security hotspots), AgentShield ✓, CodeQL ✓, dependency-audit ✓, claude-code ✓. mergeStateStatus is BLOCKED only because the org-leads team review is still requested.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

Superseded by automated re-review at 36d3e57.

[don-petry]

@dev-lead - please fix this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.