feat: implement issue #330 — [Fleet Monitor] petry-projects/ContentTwin — .github/workflows/add-to-project.yml

[don-petry]

Closes #330

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Bug Fixes

  • Updated the project automation workflow to use the stable v1 channel, improving consistency and reliability.

• Tests

  • Added validation for workflow syntax, triggers, permissions, concurrency settings, and version pinning.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

📝 Walkthrough

Walkthrough

The add-to-project workflow is pinned to the add-to-project/v1-stable reusable workflow channel. A new Bats suite validates YAML syntax, triggers, permissions, concurrency, and consistency between the workflow reference and agent_ref.

Changes

Add-to-project workflow channel

Layer / File(s)	Summary
Pin reusable workflow to v1-stable .github/workflows/add-to-project.yml	Documentation and the job’s uses reference now specify the add-to-project/v1-stable channel.
Validate workflow configuration scripts/tests/add-to-project-workflow.bats	Tests validate YAML parsing, triggers, permissions, concurrency, reusable workflow pinning, and agent_ref consistency.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is specific and clearly tied to the workflow change and issue it addresses.
Linked Issues check	✅ Passed	The changes align with issue #330 by updating the degraded workflow and adding tests to guard its expected configuration.
Out of Scope Changes check	✅ Passed	The workflow comment update and test addition are directly related to the stated workflow reliability objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-330-20260714-1012

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request introduces a new BATS test suite (scripts/tests/add-to-project-workflow.bats) to validate the structure, triggers, permissions, concurrency, and version pinning of the add-to-project GitHub workflow. Feedback on the changes suggests improving the robustness of the inline Python validation scripts by avoiding direct chaining of .get() calls, which can raise a TypeError if intermediate keys resolve to None instead of a dictionary.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-14T11:20:07Z.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed.

[Copilot]

Pull request overview

This pull request addresses issue #330 by fixing the add-to-project workflow stub to reference the correct reusable-workflow channel, preventing startup failures caused by the retiring add-to-project/stable tag and reducing Fleet Monitor-detected workflow failures.

Changes:

• Updated .github/workflows/add-to-project.yml to pin the reusable workflow to add-to-project/v1-stable.
• Added a Bats regression test to ensure the workflow stub’s uses: ref and agent_ref remain aligned on add-to-project/v1-stable, along with guardrails for triggers/permissions/concurrency.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
scripts/tests/add-to-project-workflow.bats	Adds regression tests to guard the workflow stub’s pinned channel and key invariants (triggers, permissions, concurrency).
.github/workflows/add-to-project.yml	Updates the delegated reusable workflow reference from the retiring add-to-project/stable tag to add-to-project/v1-stable.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

## Summary
**Bot:** SonarCloud & Code Review Bots
**Issues addressed:** 1
- **Workflow comment outdated after channel migration:** The AGENTS comment block in `.github/workflows/add-to-project.yml` was updated (lines 9–11) to correctly reference the pinned channel as `add-to-project/v1-stable` (matching the actual `uses:` ref and `agent_ref` values), ensuring the guidance won't mislead future maintainers. [replied + thread resolved]
**Files changed:** None (fixes were already in place in the PR)
**Additional notes:**
- **SonarCloud:** Quality Gate Passed with 0 new issues — no actionable findings
- **Gemini-code-assist suggestion skipped:** Code already defensively handles intermediate dict lookups with the `or {}` pattern; the suggestion was informational (COMMENTED, not CHANGES_REQUESTED) and the current implementation is already robust
- **No Tier 1 blockers:** All CI checks passing, no CHANGES_REQUESTED reviews

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: a371cbff7ab23bd1126ae2775957d9ef57082809
Review mode: triage-approved (single reviewer)

Summary

Fixes the add-to-project workflow stub failing at startup by moving the uses: ref from the retiring add-to-project/stable tag to the add-to-project/v1-stable channel (now matching agent_ref), and adds a bats regression suite that guards the channel pin plus the stub's trigger/permission/concurrency invariants. Triage's low-risk assessment is confirmed.

Linked issue analysis

Closes #330 (Fleet Monitor: 33.3% failure rate on .github/workflows/add-to-project.yml). Root cause was the uses: ref left on the retiring bare add-to-project/stable tag after the v-form migration (#657/#328 updated agent_ref but missed uses:), causing runs to die at startup. The one-line channel bump directly resolves this, and the new tests prevent regression. The issue is substantively addressed.

Findings

• No security concerns: change is a first-party reusable-workflow channel-tag bump on a thin caller stub; no changes to triggers, permissions (contents: read preserved), or concurrency — the new bats tests enforce these invariants stay fixed.
• Both review threads are resolved and verified in the head-SHA diff: gemini's .get() chaining concern (now uses the (x or {}).get() pattern) and Copilot's stale header comment (now references add-to-project/v1-stable).
• New test file is test-only, mirrors the existing stub-guard pattern (pr-review-mention-workflow.bats), and correctly handles PyYAML's on/True key quirk.
• Secret scan: MCP run_secret_scanning tool unavailable in this run; gitleaks CI check passed and the diff contains no secret-like content (PVT_… is a public project node ID).

CI status

All substantive checks green at a371cbf: Lint, Format, Test, Secret scan (gitleaks), CodeQL, SonarCloud (quality gate passed, 0 new issues), AgentShield, dependency-audit, CodeRabbit status SUCCESS. Two CANCELLED entries (dev-lead dispatch/ci-relay at 10:28) are the Dev-Lead agent's own superseded orchestration jobs, not code checks; the earlier dev-lead run at this PR succeeded.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

🧹 Nitpick comments (1)

scripts/tests/add-to-project-workflow.bats (1)

26-26: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use a context manager to open the file and avoid ResourceWarning flakes.

Opening a file without closing it can cause Python to emit a ResourceWarning to stderr. Because bats captures both stdout and stderr into the $output variable, this warning would cause the exact string match [[ "$output" == "ok" ]] to fail if Python warnings are ever enabled in the runner environment.

Consider using a with statement to handle the file lifecycle cleanly across these tests:

• scripts/tests/add-to-project-workflow.bats#L26-L26: Refactor the one-liner to either explicitly close the file (e.g. f = open(...); yaml.safe_load(f); f.close()) or pipe the file via sys.stdin.
• scripts/tests/add-to-project-workflow.bats#L33-L33: Refactor to use a context manager: with open(sys.argv[1]) as f: wf = yaml.safe_load(f) or {}.
• scripts/tests/add-to-project-workflow.bats#L46-L46: Refactor to use a context manager for yaml.safe_load.
• scripts/tests/add-to-project-workflow.bats#L59-L59: Refactor to use a context manager for yaml.safe_load.
• scripts/tests/add-to-project-workflow.bats#L73-L73: Refactor to use a context manager for yaml.safe_load.
• scripts/tests/add-to-project-workflow.bats#L87-L87: Refactor to use a context manager for yaml.safe_load.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/tests/add-to-project-workflow.bats` at line 26, Update each
yaml.safe_load invocation in scripts/tests/add-to-project-workflow.bats at lines
26, 33, 46, 59, 73, and 87 to open the workflow file with a context manager,
preserving the existing parsed-data behavior and exact test output. At line 26,
either explicitly close the file or read it through standard input; all other
listed sites should use context-managed file handles.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/tests/add-to-project-workflow.bats`:
- Line 26: Update each yaml.safe_load invocation in
scripts/tests/add-to-project-workflow.bats at lines 26, 33, 46, 59, 73, and 87
to open the workflow file with a context manager, preserving the existing
parsed-data behavior and exact test output. At line 26, either explicitly close
the file or read it through standard input; all other listed sites should use
context-managed file handles.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fdba2e3a-d1cd-4218-8a21-462f81af30e8

📥 Commits

Reviewing files that changed from the base of the PR and between 823bc7b and 2925736.

📒 Files selected for processing (2)

• .github/workflows/add-to-project.yml
• scripts/tests/add-to-project-workflow.bats