feat: implement issue #402 — Compliance: dev-lead-stub-pin

[don-petry]

User description

Closes #402

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Align the dev-lead workflow with the supported v1-stable release channel

What Changed

• The dev-lead workflow now loads its reusable workflow and agent configuration from the matching dev-lead/v1-stable channel
• Workflow checks now prevent the reusable workflow and agent configuration from drifting to different or unsupported channels

Impact

✅ Fewer dev-lead startup failures
✅ Consistent agent execution

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Updated the development workflow to use the dev-lead/v1-stable release channel.
  • Updated workflow validation checks to ensure the new channel is configured consistently.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Incremental review completed	aee30d8	Jul 31, 2026 · 16:30	16:30
✅ Reviewed your PR	8a8c905	Jul 31, 2026 · 14:30	14:31

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d9860e5d-a974-4b77-98a2-c1112c3fed73

📥 Commits

Reviewing files that changed from the base of the PR and between 83dbdd6 and f7a36ac.

📒 Files selected for processing (2)

• .github/workflows/dev-lead.yml
• scripts/tests/dev-lead-workflow.bats

---

📝 Walkthrough

Walkthrough

The dev-lead reusable workflow reference and agent_ref now use dev-lead/v1-stable. The workflow guard documentation and Bats expectations enforce the same channel.

Changes

Dev-lead channel synchronization

Layer / File(s)	Summary
Workflow pin and guard validation .github/workflows/dev-lead.yml, scripts/tests/dev-lead-workflow.bats	The workflow reference, agent_ref, comments, and test expectations now use dev-lead/v1-stable. Tests continue to verify both references.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• petry-projects/ContentTwin#331: Updates the reusable workflow and agent_ref to the /v1-stable channel.
• petry-projects/ContentTwin#361: Updates the workflow channel checks in dev-lead-workflow.bats.
• petry-projects/ContentTwin#406: Makes the same dev-lead/stable to dev-lead/v1-stable updates.

Suggested labels: standards-sync

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies implementation of compliance issue #402 for the dev-lead stub pin.
Linked Issues check	✅ Passed	The workflow now uses and validates the required major-scoped dev-lead/v1-stable channel for both references.
Out of Scope Changes check	✅ Passed	All changes are limited to the dev-lead workflow pin and its corresponding guard test.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-402-20260731-1424

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the channel pin reference in the dev-lead workflow tests from dev-lead/stable to dev-lead/v1-stable within comments and test assertions. There are no review comments to evaluate, and I have no feedback to provide.

[qodo-code-review]

PR Summary by Qodo

Pin dev-lead workflow to dev-lead/v1-stable channel (and enforce via tests)

⚙️ Configuration changes 🧪 Tests 🕐 10-20 Minutes

AI Description

• Re-pin the dev-lead reusable workflow from dev-lead/stable to dev-lead/v1-stable.
• Keep agent_ref aligned to the same v1-stable channel to avoid drift.
• Update Bats guards to enforce the new pinning invariant.

Diagram

graph TD
  WF["dev-lead.yml"] --> RW["Reusable workflow @dev-lead/v1-stable"] --> AR["agent_ref = dev-lead/v1-stable"]
  T["dev-lead-workflow.bats"] --> WF

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin reusable workflow to an immutable commit SHA

• ➕ Fully reproducible and resistant to upstream tag movement
• ➕ Eliminates ambiguity about what code executed
• ➖ Requires frequent manual updates in every caller repo
• ➖ Increases risk of callers staying outdated (the problem this channel system avoids)

2. Pin to a versioned release tag (e.g., dev-lead/v1.x.y)

• ➕ Strong stability guarantee; easy rollback by selecting prior release
• ➕ Clear upgrade intent when bumping versions
• ➖ Still requires caller edits to upgrade
• ➖ May slow incident fixes if many repos need coordinated bumps

Recommendation: Keep the PR’s approach: moving dev-lead/v1-stable is a good balance between safety (not @main, avoids circular gating) and operability (central promotion without editing each caller). The added Bats assertions are appropriate to prevent accidental drift between uses: and agent_ref.

Files changed (2) +10 / -10

Tests (1) +6 / -6

dev-lead-workflow.batsUpdate workflow pinning invariants to v1-stable +6/-6

Update workflow pinning invariants to v1-stable

• Adjusts Bats tests and commentary to enforce pinning to dev-lead/v1-stable rather than dev-lead/stable. Keeps the guard that requires agent_ref to match the uses: channel.

scripts/tests/dev-lead-workflow.bats

Other (1) +4 / -4

dev-lead.ymlRe-pin dev-lead reusable workflow to dev-lead/v1-stable +4/-4

Re-pin dev-lead reusable workflow to dev-lead/v1-stable

• Updates the reusable workflow reference from dev-lead/stable to dev-lead/v1-stable. Aligns the agent_ref input to the same channel and updates surrounding rationale comments accordingly.

.github/workflows/dev-lead.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-31T15:03:53Z

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-31T15:34:21Z.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #409
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-31T15:08:07Z

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 8a8c905dc807b91ed8cfc49da640c53e559992db
Review mode: triage-approved (single reviewer)

Summary

Small compliance PR re-pinning the dev-lead caller stub from the tier channel tag dev-lead/stable to the major-scoped dev-lead/v1-stable, with matching bats guard updates. The changed workflow hunk matches the org standards template (standards/workflows/dev-lead.yml) verbatim, and the dev-lead/v1-stable tag exists in petry-projects/.github-private (resolves to 6d36231). Confirms the triage assessment: focused, standard-conformant, no security concerns.

Linked issue analysis

Closes #402 (Compliance: dev-lead-stub-pin), which requires the caller stub to pin a major-scoped dev-lead channel tag (dev-lead/v-) instead of the bare tier pin. The PR updates uses: and agent_ref to dev-lead/v1-stable, keeping both on the same channel as the bats guard requires, and updates the guard tests to enforce the new invariant. The remediation (re-sync from the standards template) is substantively satisfied — the resulting workflow hunk is byte-identical to the template.

Findings

No blocking findings.

• Workflow change surface: only the channel ref in uses:/agent_ref and comments changed; permissions, secrets: inherit, triggers, and concurrency safeguards are untouched (verified against the diff and the org template).
• Tests: bats invariants updated consistently; the agent_ref==uses-channel guard is preserved.
• Secret scan: the run_secret_scanning MCP tool is not available in this environment; noting per protocol. The gitleaks CI check passed and the diff contains no secret-like content.
• Prior hold: the 14:34 rate-limit marker (reset 2026-07-31T15:34:21Z) has expired; Qodo (no issues), Gemini (no feedback), CodeAnt, SonarCloud, and Graphite have all since reported.

CI status

All substantive checks green at 8a8c905: CI Lint/Format/Test, Secret scan (gitleaks), CodeQL, SonarCloud (quality gate passed, 0 hotspots), AgentShield, dependency-audit, CodeRabbit status SUCCESS, Graphite AI Reviews. The three CANCELLED runs (dev-lead / dispatch, dev-lead / ci-relay, pr-auto-review / check-and-dispatch) are from a superseded pull_request_review-triggered run cancelled by centralized concurrency; the later runs of the same checks completed SUCCESS/SKIPPED.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- Quality Gate passed; 0 new issues, 0 hotspots (informational only)
Files changed: None required
Skipped (informational): 1
```

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud