feat: implement issue #264 — [Fleet Monitor] petry-projects/ContentTwin — .github/workflows/dependency-audit.yml

[don-petry]

Closes #264

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Improved dependency audit workflow to automatically cancel redundant checks when multiple code changes are pushed concurrently.
  • Added validation tests for dependency audit workflow configuration.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 48 minutes and 21 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c40303c7-0152-4136-a395-18b339000e8a

📥 Commits

Reviewing files that changed from the base of the PR and between 387cfa7 and 638c1a7.

📒 Files selected for processing (1)

• .github/workflows/dependency-audit.yml

📝 Walkthrough

Walkthrough

A concurrency block is added to .github/workflows/dependency-audit.yml, grouping runs by dependency-audit-${{ github.ref }} and cancelling in-progress runs when a new run starts. A new Bats test script is introduced to validate the workflow's YAML structure, branch triggers, reusable workflow reference, job name, and the new concurrency settings.

Changes

Dependency-audit concurrency and Bats validation

Layer / File(s)	Summary
Concurrency block in workflow .github/workflows/dependency-audit.yml	Adds a concurrency block scoped to dependency-audit-${{ github.ref }} with cancel-in-progress: true; no other workflow properties are modified.
Bats test suite for workflow invariants scripts/tests/dependency-audit-workflow.bats	New test script with a PyYAML-backed query() helper that asserts valid YAML, pull_request and push triggers target main, the dependency-audit job and its pinned uses reference are unchanged, and the concurrency group and cancel-in-progress setting are present.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• petry-projects/ContentTwin#161: Modifies concurrency.group with cancel-in-progress in ci.yml, using the same pattern now applied to dependency-audit.yml.

Suggested reviewers

• donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title references issue #264 and the specific workflow file being modified, clearly indicating the main change.
Linked Issues check	✅ Passed	The PR addresses the high failure rate (10.7%) by adding concurrency configuration to cancel redundant runs, which helps reduce waste and potential cascading failures.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to the dependency-audit workflow: concurrency config in the workflow file and comprehensive tests validating the implementation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-264-20260614-0956

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a new BATS test suite (scripts/tests/dependency-audit-workflow.bats) to validate the configuration of the .github/workflows/dependency-audit.yml workflow, ensuring its triggers, job name, reusable workflow reference, and concurrency settings remain correct. The reviewer suggested improving the robustness of the Python-based query helper function by using safe dictionary lookups to prevent unhandled exceptions if the workflow file is empty or misconfigured.

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/dependency-audit.yml (1)

31-37: 💤 Low value

Consider using ${{ github.workflow }} for consistency with sonarcloud.yml.

The concurrency group uses a hardcoded dependency-audit prefix, while .github/workflows/sonarcloud.yml (context snippet 1) uses the dynamic ${{ github.workflow }} variable in its group pattern. Using ${{ github.workflow }}-${{ github.ref }} would maintain consistency across workflow files and automatically reflect any future workflow name changes.

♻️ Suggested change for consistency

 concurrency:
-  group: dependency-audit-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/dependency-audit.yml around lines 31 - 37, In the
`.github/workflows/dependency-audit.yml` file, the concurrency group uses a
hardcoded `dependency-audit` prefix instead of the dynamic workflow variable.
Replace the hardcoded prefix in the group field with `${{ github.workflow }}` to
match the pattern used in `sonarcloud.yml`, so the group becomes `${{
github.workflow }}-${{ github.ref }}`. This ensures consistency across workflow
files and allows the concurrency group to automatically reflect any future
workflow name changes without requiring manual updates.

scripts/tests/dependency-audit-workflow.bats (1)

56-66: 💤 Low value

Consider validating the exact concurrency group value.

The test at lines 56-60 only checks that concurrency.group is truthy, not that it matches the expected value dependency-audit-${{ github.ref }}. Adding a test for the exact group value would more thoroughly lock the invariant mentioned in the file header (line 8: "repo-local reliability addition").

📝 Optional test addition for exact group validation

 `@test` "concurrency cancels superseded in-progress runs" {
   run query "data['concurrency']['cancel-in-progress']"
   [ "$status" -eq 0 ]
   [ "$output" = "True" ]
 }
+
+@test "concurrency group is keyed to dependency-audit and ref" {
+  run query "data['concurrency']['group']"
+  [ "$status" -eq 0 ]
+  [ "$output" = "dependency-audit-\${{ github.ref }}" ]
+}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/tests/dependency-audit-workflow.bats` around lines 56 - 66, The test
"concurrency group is defined" currently only validates that the
concurrency.group field is truthy using a bool() check, rather than verifying it
matches the expected value. Modify the query in this test to check that
data['concurrency']['group'] equals the expected value "dependency-audit-${{
github.ref }}" instead of just validating its boolean truthiness. This will
provide more thorough validation of the repo-local reliability invariant
mentioned in the file header.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/dependency-audit.yml:
- Around line 31-37: In the `.github/workflows/dependency-audit.yml` file, the
concurrency group uses a hardcoded `dependency-audit` prefix instead of the
dynamic workflow variable. Replace the hardcoded prefix in the group field with
`${{ github.workflow }}` to match the pattern used in `sonarcloud.yml`, so the
group becomes `${{ github.workflow }}-${{ github.ref }}`. This ensures
consistency across workflow files and allows the concurrency group to
automatically reflect any future workflow name changes without requiring manual
updates.

In `@scripts/tests/dependency-audit-workflow.bats`:
- Around line 56-66: The test "concurrency group is defined" currently only
validates that the concurrency.group field is truthy using a bool() check,
rather than verifying it matches the expected value. Modify the query in this
test to check that data['concurrency']['group'] equals the expected value
"dependency-audit-${{ github.ref }}" instead of just validating its boolean
truthiness. This will provide more thorough validation of the repo-local
reliability invariant mentioned in the file header.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7072e553-699c-41e1-9754-a349fddb4973

📥 Commits

Reviewing files that changed from the base of the PR and between 45830f9 and 387cfa7.

📒 Files selected for processing (2)

• .github/workflows/dependency-audit.yml
• scripts/tests/dependency-audit-workflow.bats

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 0 threads:
  (none — OPEN_THREADS_JSON was empty)
Tier 1 blockers: none
  - No CI checks with failure/timed_out/cancelled/action_required/stale/startup_failure
  - No reviews with CHANGES_REQUESTED
Test verification: PASS — 7/7 bats tests passed
  ok 1 workflow is valid YAML
  ok 2 trigger: pull_request targets main (unchanged)
  ok 3 trigger: push targets main (unchanged)
  ok 4 uses: reusable pinned line is unchanged
  ok 5 job name 'dependency-audit' is unchanged
  ok 6 concurrency group is defined
  ok 7 concurrency cancels superseded in-progress runs
Files changed: none
Notes:
  The coderabbitai review contained two nitpick suggestions (💤 Low value, not
  open threads): (1) use ${{ github.workflow }} in the concurrency group, and
  (2) add an exact-value assertion in the bats test. These were not open
  threads and carry no CHANGES_REQUESTED state, so they are out of scope per
  task constraints. No action taken.
```

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 387cfa7149731213a71fe87d41915f5f90defc6e
Review mode: triage-approved (single reviewer)

Summary

Adds a concurrency block (group: dependency-audit-${{ github.ref }}, cancel-in-progress: true) to the dependency-audit.yml caller stub, mirroring ci.yml, plus a new Bats suite that locks the branch-protection invariants (triggers, the pinned uses: line, the job name) and asserts the new concurrency settings. Scoped, caller-local reliability change with tests; no behavioral change to triggers, the reusable reference, or the required job name.

Linked issue analysis

Closes #264 (Fleet Monitor: dependency-audit.yml at 10.7% failure rate, 14/131 runs). The caller stub can only tune caller-local levers; the reusable workflow logic is org-level and out of scope. Cancelling superseded in-progress runs on the same ref is the appropriate in-scope mitigation for redundant concurrent runs and is consistent with the repo's recently-merged pr-review gate fix (#609) that no longer treats concurrency-cancelled checks as blocking.

Findings

No blocking findings.

• CodeRabbit raised 2 low-value nitpicks (prefer ${{ github.workflow }} over the hardcoded prefix; assert the exact concurrency group value in the test). Both are stylistic/optional, not open threads, and carry no CHANGES_REQUESTED. Reasonable to defer.
• gemini-code-assist suggested safer dict lookups in the Python query() helper. The helper is test-only scaffolding over a known-good workflow file; current .get fallbacks already handle the YAML 1.1 'on' boolean key. Non-blocking.
• Change does not touch permissions, secrets, triggers, the pinned uses: line, or the required job name. No GitHub Actions security smell; cancellation is scoped per-ref.

CI status

All green or skipped: CodeQL (Analyze actions) SUCCESS, CodeQL SUCCESS, CodeRabbit SUCCESS, pr-auto-review/check-and-dispatch SUCCESS, dev-lead/dispatch SUCCESS; review/review and dev-lead/ci-relay SKIPPED. mergeStateStatus BLOCKED only on REVIEW_REQUIRED (this review). dev-lead reported 7/7 Bats tests passing.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- SonarCloud Quality Gate: Passed (no new issues detected)
Files changed: None
Skipped (deferred, not Tier 1): 2 low-value CodeRabbit nitpicks
```

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: uses: reusable pinned line is unchanged (BATS test in scripts/tests/dependency-audit-workflow.bats)
Root cause: Test failure

The BATS test on line 47 asserts the uses: value equals petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1, but the actual workflow pins to the full commit SHA @376a4fcb1117444595e3e702fa450873d0e54310. SonarCloud flags this as a failing quality gate because the test expectation was written against a tag reference (@v1) that does not match the SHA-pinned reference the workflow actually uses. This is a stale or incorrect test fixture — the test was never updated to match the real pin.

Suggested fix: Update the expected string in scripts/tests/dependency-audit-workflow.bats line 47 to match the actual commit SHA pin: change @v1 to @376a4fcb1117444595e3e702fa450873d0e54310.

View run logs