fix: pin dependabot-automerge reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml from the @v1 tag to its resolved commit SHA (ae9709f4466dec60a5733c9e7487f69dcd004e05)
• Satisfies the action-pinning policy flagged by the weekly compliance audit

Closes #58

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 10 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 00a68dd6-6042-4c81-90e4-60cb77f6e58a

📥 Commits

Reviewing files that changed from the base of the PR and between 7d7648c and 17d312d.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-58-20260414-1351

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — PR is ready for review and merge.

[Copilot]

Pull request overview

Pins the Dependabot auto-merge reusable workflow reference to an immutable commit SHA to comply with the repository’s action-pinning policy and clear the compliance audit finding (#58).

Changes:

• Update .github/workflows/dependabot-automerge.yml to use the resolved commit SHA instead of the moving v1 tag for the reusable workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The header comment says you "MUST NOT change" the uses: line, but this PR intentionally changes it to satisfy the action-pinning policy. Please update the header guidance to allow/expect SHA pinning (or clarify that pinning the ref is the only permitted change), so future contributors aren’t misled.

[don-petry]

Superseded by automated re-review at 17d312dc3bf50af0f56cc6eae74f6f740cde3a2a — click to expand prior review.

Automated review — APPROVED

Risk: LOW
Reviewed commit: 2aa39b79db1a19306a13567abbc75ed5d54206f5
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Single-line change pinning a reusable workflow reference from a mutable @v1 tag to its resolved commit SHA (ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1), directly addressing the compliance finding in issue #58. All CI checks pass (CodeQL, SonarCloud with 0 security hotspots, AgentShield, Lint, Format), the change is well-structured, and it strictly improves the security posture of the workflow by replacing a mutable tag with an immutable SHA.

Findings

Info

• .github/workflows/dependabot-automerge.yml:39 — Pinning from mutable tag @v1 to commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 is the correct remediation for the action-pinning policy; inline comment # v1 aids future maintainability.
• .github/workflows/dependabot-automerge.yml:40 — secrets: inherit passes all repo secrets to the reusable workflow. This was present before this PR and is unchanged; not introduced by this change. Worth noting for a future audit of the reusable workflow's secret consumption.

CI status

All CI checks pass: CodeQL, SonarCloud (0 security hotspots), AgentShield, Lint, Format.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[donpetry-bot]

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.