feat: implement issue #226 — Compliance: check-suite-auto-trigger-1236702

[don-petry]

Closes #226

Implemented by dev-lead agent. Please review.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[Copilot]

Pull request overview

This PR updates the repository settings enforcement workflow to better remediate compliance issue #226 by ensuring the repo-settings script can run automatically even when no relevant files change.

Changes:

• Add the workflow file itself to the push.paths filter so edits to the workflow will trigger a settings re-apply.
• Add a weekly scheduled run (Mondays 06:00 UTC) to re-apply settings and reduce drift over time.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
Tier-1 blocker — dev-lead / dispatch (failure):
  Root cause: transient fetch_pr_context error in dev-lead reusable pipeline;
  not caused by this PR's code changes. No fix applicable in this repo.
```

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 44 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 1e63469a-b6c3-4a7d-a318-548d36c15f9b

📥 Commits

Reviewing files that changed from the base of the PR and between 7c4a65a and 7ad5da3.

📒 Files selected for processing (1)

• .github/workflows/apply-repo-settings.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-226-20260608-2009

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

| Metric | Status |
|--------|--------|
| Bot comment | Empty |
| CI checks | All passed ✓ |
| Review blockers | None (Copilot review is informational only) |
| Files changed | 1 (`.github/workflows/apply-repo-settings.yml`) |
The PR successfully addresses issue #226 by:
- Adding the workflow file itself to the `paths` filter so edits trigger a re-apply
- Adding a weekly Monday 06:00 UTC scheduled run to re-enforce settings and prevent drift
All automated checks (Analyze, CodeQL, CodeRabbit) have passed. No code changes are needed.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: c0fda86292910b35c7d8a32632d75f3d6c3b65eb
Review mode: triage-approved (single reviewer)

Summary

Adds the workflow file to its own push paths filter and a weekly Monday 06:00 UTC scheduled run to re-enforce repo settings and prevent drift (3 lines, 1 file). Permissions remain minimal and correctly scoped; checkout action is SHA-pinned. Confirms triage low-risk assessment.

Linked issue analysis

Closes #226 (compliance: check-suite-auto-trigger). The remediation is running scripts/apply-repo-settings.sh. The existing workflow ran it on push to settings.yml/script; this PR adds a weekly schedule so settings are re-applied periodically to prevent drift, and triggers a re-apply when the workflow itself is edited. Substantively addresses the drift-prevention goal.

Findings

• No security smells: top-level permissions: {}, administration: write scoped to the single job, GH_TOKEN from secrets.GITHUB_TOKEN.
• actions/checkout pinned to SHA per action-pinning policy.
• Schedule runs on the default branch (main), consistent with the workflow's intent.
• No new permissions introduced; only trigger surface (paths + schedule) expanded.
• No blocking findings. Copilot review is COMMENTED (informational); CodeRabbit was rate-limited but its status check reports SUCCESS.

CI status

All green: CodeQL Analyze (actions) SUCCESS, CodeQL Analyze (python) SUCCESS, CodeQL SUCCESS, CodeRabbit SUCCESS.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[don-petry]

Dev-Lead — rebase (applied)

Rebase completed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- No new code issues detected; quality gate PASSED
Files changed: .github/workflows/apply-repo-settings.yml (workflow configuration only)
Skipped (informational): 0
Status: ✅ All quality gates green — ready for merge once in_progress check completes
```
The PR is clean from a bot analysis perspective. The CANCELLED ci-relay checks are expected per the commit message directive.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 7ad5da3049beeb7a916420b4fc4b66362c65a072
Review mode: triage-approved (single reviewer)

Summary

Adds the workflow's own path to its push-trigger paths filter and a weekly Monday 06:00 UTC schedule cron to .github/workflows/apply-repo-settings.yml (+3/-0, single file). The schedule periodically re-applies repo security settings to prevent the configuration drift that caused compliance issue #226 (Claude auto-trigger creating queued check suites that block auto-merge).

Linked issue analysis

Closes #226 (compliance: check-suite-auto-trigger-1236702), which is already CLOSED. The issue's one-shot remediation runs scripts/apply-repo-settings.sh; this PR additionally makes enforcement durable by scheduling weekly re-application, directly addressing the root cause (drift). Linked issue is substantively addressed.

Findings

No issues found.

• Workflow follows least privilege: top-level permissions: {} with job-level contents: read only; the admin operation uses the scoped GH_PAT_WORKFLOWS secret.
• actions/checkout is SHA-pinned (v6.0.2) with a refresh comment per the pinning policy.
• No GitHub Actions security smells: the added schedule and paths entries introduce no untrusted-input interpolation or injection surface.
• Secret-scanning MCP tool not exposed in this environment; relied on the green gitleaks CI check. A trigger-only diff carries no secret material.

CI status

All required checks green: CodeQL (actions, python), gitleaks secret scan, SonarCloud, agent-shield/AgentShield, review, pr-auto-review. dependency-audit ecosystem jobs and dependabot-automerge are SKIPPED (no matching ecosystems); dev-lead/ci-relay and dev-lead/dispatch are CANCELLED (transient, non-blocking, noted by author in PR comments). No failing checks.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: Quality Gate
Root cause: Lint/style

SonarCloud's Quality Gate failed because the analysis detected 5 new Security Hotspots on this PR. Security Hotspots are code patterns that SonarCloud flags as requiring manual review to confirm whether they pose a real security risk. The PR adds a schedule trigger to the apply-repo-settings.yml workflow; scheduled workflows execute with repository credentials on a timer, which SonarCloud flags as a hotspot because improperly scoped permissions in scheduled workflows can be abused.

Suggested fix: Open the SonarCloud Security Hotspots view for this branch, review each of the 5 flagged hotspots, and either mark them as "Safe" (if the risk is accepted) or tighten the permissions: block in the workflow to use least-privilege scopes — then the Quality Gate will pass.

View run logs