fix(ci): pin feature-ideation-reusable.yml to SHA (compliance #104)

[don-petry]

Summary

• Pins feature-ideation-reusable.yml@v1 to its resolved commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 to comply with the org Action Pinning Policy
• Syncs the file with the current standard template (petry-projects/.github/standards/workflows/feature-ideation.yml) verbatim:
  • Adds dry_run workflow_dispatch input
  • Adds actions: read permission (required for feed checkpoint)
  • Updates header comments with current "To adopt" steps

Changes

File	Change
.github/workflows/feature-ideation.yml	Pin SHA + sync with template

Closes #104

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 59 minutes and 37 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d6d4f4d0-c5f0-42df-b909-0a338d646d38

📥 Commits

Reviewing files that changed from the base of the PR and between 916519a and 6d7d790.

📒 Files selected for processing (1)

• .github/workflows/feature-ideation.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-104-20260420-0333

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review complete

Changes verified:

• ✅ SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 confirmed to exist in petry-projects/.github
• ✅ File copied verbatim from standards/workflows/feature-ideation.yml
• ✅ Key fix: @v1 → @ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1
• ✅ Template additions synced: dry_run input, actions: read permission, updated header

CI status:

• ✅ AgentShield: passed
• ✅ Claude Code: passed
• 🔄 CodeQL, TypeScript, Go, SonarCloud: in progress
• ⚠️ dependency-audit / pnpm audit: failing — this is pre-existing on main (broken lockfile, ERR_PNPM_BROKEN_LOCKFILE) and unrelated to this change

@don-petry — ready for your review. This resolves the compliance finding in issue #104.

[Copilot]

Pull request overview

Pins the feature-ideation reusable workflow reference to an immutable commit SHA to satisfy the org Action Pinning Policy and syncs the caller stub to the current central template.

Changes:

• Pin petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to @ae9709f4466dec60a5733c9e7487f69dcd004e05.
• Sync template updates: add dry_run workflow_dispatch input and pass-through with.dry_run.
• Expand job permissions to include actions: read and refresh adoption/header guidance comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 6d7d7904cde54ec37d39bed44781371cbe161ad2
Review mode: triage-approved (single reviewer)

Summary

Triage flagged this as a low-risk SHA-pinning compliance fix, but confirmation review found a runtime correctness bug: the pinned SHA's reusable workflow does not accept the dry_run input that this PR passes to it. The workflow will fail validation when triggered. The PR also carries unresolved merge conflicts with main (DIRTY state, ~6 weeks of auto-rebase failures).

Linked issue analysis

Issue #104 is the org-wide compliance finding requesting that feature-ideation-reusable.yml@v1 be pinned to a SHA. The PR correctly addresses the headline ask (replaces @v1 with @ae9709f… # v1). Issue is already closed.

Findings

🛑 Correctness (blocking) — pinned SHA doesn't support the inputs being passed

The PR pins to petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@ae9709f4466dec60a5733c9e7487f69dcd004e05 (commit dated 2026-04-08 — that commit is actually a docs(dependabot) change and doesn't touch the reusable workflow at all).

At that SHA the reusable workflow's on.workflow_call.inputs block accepts only: project_context, focus_area, research_depth, model, timeout_minutes. It does not accept dry_run or sources_file.

But the caller now passes:

with:
  ...
  dry_run: ${{ inputs.dry_run || false }}

When this workflow runs (scheduled cron or workflow_dispatch), GitHub Actions will reject the call with an Invalid input(s) 'dry_run' validation error. The feature-ideation pipeline will be broken in this repo until fixed.

The dry_run and sources_file inputs were added to the reusable workflow in commit ee22b427cb on 2026-04-17 (and refined in 492f3ebfc3 on 2026-04-19). The PR appears to have been generated by syncing against the current standards/workflows/feature-ideation.yml template while pinning to an older reusable workflow SHA — the template and the workflow have drifted apart.

Recommended fixes (pick one):

1. Bump the pin to a SHA that actually exposes dry_run — e.g. ee22b427cb (2026-04-17, the commit that introduced the feature) or a more recent v1-tagged SHA such as 21ea07ee7f (2026-05-24). Verify by inspecting tag v1 directly: gh api repos/petry-projects/.github/git/ref/tags/v1.
2. Or drop the dry_run: line (and the dry_run workflow_dispatch input) so the caller only passes inputs that the pinned reusable workflow accepts. The actions: read permission is harmless (the workflow at this SHA doesn't need it, but extra read permissions don't break anything).

⚠️ Process — merge conflict

mergeable: CONFLICTING, mergeStateStatus: DIRTY. Auto-rebase has been failing since 2026-05-19 (most recent failure 2026-06-01). Branch needs a manual rebase/merge against main before it can be merged.

Notes

• The author's self-review claimed the file was "copied verbatim from standards/workflows/feature-ideation.yml" — that's accurate against the current template but masks the pinning mismatch above.
• The pre-existing pnpm audit failure called out in the self-review is unrelated to this change and consistent with main.

CI status

At head 6d7d7904:

• ✅ CodeQL (actions, go, javascript-typescript) — SUCCESS
• ✅ CodeRabbit — SUCCESS
• ⚠️ Other checks (TypeScript, Go, SonarCloud, dependency-audit) not present in the latest status rollup — branch is stale and many checks won't re-run until conflicts are resolved.
• SonarCloud Quality Gate (older comment on 2026-05-11) — passed.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.