feat: implement issue #251 — Compliance: non-stub-dependabot-automerge.yml

[don-petry]

Closes #251

Implemented by dev-lead agent. Please review.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 59 minutes and 25 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e5fe91bc-e7d0-4315-bb46-4b7e4a0c51a3

📥 Commits

Reviewing files that changed from the base of the PR and between 61aa4ee and a3eef70.

📒 Files selected for processing (2)

• .github/workflows/dependabot-automerge.yml
• .gitignore

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-251-20260526-1710

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request adds a duplicate .dev-lead/ entry to the .gitignore file. The reviewer correctly pointed out that this entry is already defined multiple times in the file and the redundant addition should be removed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84e384bdf4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Brings this repository into compliance with issue #251 by updating the Dependabot auto-merge thin-caller workflow to reference the org reusable workflow via the standard @v1 tag.

Changes:

• Update .github/workflows/dependabot-automerge.yml to use petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.
• Add another .dev-lead/ entry to .gitignore (resulting in repeated duplicates).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
.gitignore	Adds an additional .dev-lead/ ignore entry (currently duplicated multiple times).
.github/workflows/dependabot-automerge.yml	Pins the reusable workflow reference to @v1 to satisfy the compliance requirement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (Quality Gate)
Root cause: Config error

The PR changes .github/workflows/dependabot-automerge.yml to reference the reusable workflow via a mutable tag (@v1) instead of the previously pinned commit SHA (376a4fcb1117444595e3e702fa450873d0e54310). SonarCloud flags unpinned GitHub Actions workflow references as a security vulnerability (CWE-829 / supply chain risk), because a mutable tag can be silently redirected to malicious code. Additionally, a duplicate .dev-lead/ entry was added to .gitignore, which may register as a minor code smell.

Suggested fix: Revert the workflow reference back to the pinned SHA — replace @v1 with @376a4fcb1117444595e3e702fa450873d0e54310 in dependabot-automerge.yml.

View run logs

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis
Root cause: Env issue

SonarCloud requires the SONAR_TOKEN secret to authenticate and post analysis results, but this secret is typically restricted for Dependabot PRs by GitHub Actions security policy. This PR only modifies .github/workflows/dependabot-automerge.yml (downgrading the reusable workflow reference from a pinned SHA at v2 to the mutable @v1 tag), so no source code changed — the failure is almost certainly an authentication/secret availability issue rather than a code quality problem.

Suggested fix: Add a SonarCloud workflow step that explicitly handles Dependabot PRs by using pull_request_target trigger (which has access to secrets) instead of pull_request, or add a repository secret permissions exception for Dependabot via Settings → Secrets → Dependabot to expose SONAR_TOKEN to Dependabot-triggered workflows.

View run logs

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.