feat: implement issue #250 — Compliance: non-stub-dependency-audit.yml

[don-petry]

Closes #250

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 38 minutes and 23 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5e6e3e9d-1f0d-45b1-91db-2918951c2bcb

📥 Commits

Reviewing files that changed from the base of the PR and between 53cd0fe and 75a5a32.

📒 Files selected for processing (1)

• .github/workflows/dependency-audit.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-250-20260619-1534

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Dev-Lead — rebase (no-changes)

Agent reasoning

PR: #323
Rebased onto: main
Conflicts resolved: 1 file
- .github/workflows/dependency-audit.yml: PR uses @v1 (non-stub, issue #250's intent); main had @dependency-audit/stable from a later org-sync PR (#338) — kept the PR's @v1 per policy
Push: success
```

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
- No actionable issues found — Quality Gate passed with zero new violations
Files changed: None
Skipped: 0
```
**Conclusion:** This PR is in good shape. The SonarCloud bot comment reports a clean quality gate with no code issues, security hotspots, or coverage regressions on new code. No fixes needed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 75a5a32a837c0d0161558b01cb0667ae64104853
Review mode: triage-approved (single reviewer)

Summary

Single-line change to the dependency-audit thin-caller stub, repinning the reusable workflow ref from @dependency-audit/stable to @v1. This is the canonical org-standard ref and brings the repo into compliance.

Linked issue analysis

Closes #250, a compliance finding (non-stub-dependency-audit.yml) requiring the centralized dependency-audit.yml to pin the reusable to @v1 per org standard. The diff changes exactly that line, and the resulting file matches the canonical stub verbatim (header comments, triggers, job name, and uses: line all align). Issue substantively addressed.

Findings

No issues. Change is limited to a first-party org reusable-workflow ref bump to the mandated @v1 tag; no new permissions, no third-party actions, no logic change. MCP secret scan was unavailable (permission not granted in this run) — noted, not blocking; the gitleaks CI check passed and a one-line ref change cannot carry secrets.

CI status

All required checks green (AgentShield, CodeQL x4, SonarCloud, gitleaks, govulncheck, pnpm/npm audit Detect ecosystems, TypeScript, Go, dev-lead, pr-auto-review, CodeRabbit). Inapplicable ecosystem audits and image-push correctly SKIPPED. mergeStateStatus BLOCKED only due to REVIEW_REQUIRED, which this review satisfies.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 75a5a32a837c0d0161558b01cb0667ae64104853
Review mode: triage-approved (single reviewer)

Summary

One-line compliance fix: pins the centralized dependency-audit workflow's reusable reference from the rolling branch '@dependency-audit/stable' to the org-standard tag '@v1', exactly as requested by compliance issue #250. No logic, secrets, or behavioral changes.

Linked issue analysis

Closes #250 (compliance finding 'non-stub-dependency-audit.yml'). The issue required the workflow to delegate to 'petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1' per the org centralization standard. The diff makes precisely that change. Issue is substantively addressed.

Findings

No issues found. The single changed line updates a first-party reusable-workflow ref to the org-mandated '@v1' tag — this is the requested remediation, not a security smell. MCP secret-scanning tool was unavailable in this run (permission not granted); the gitleaks CI secret scan passed (SUCCESS) and the diff contains no secret material. Advisory bots (Codex, Gemini, CodeRabbit) produced no substantive findings — they were rate-limited or did not support the file type. SonarCloud quality gate passed.

CI status

All required checks green or appropriately skipped. Notable: Secret scan (gitleaks) SUCCESS, CodeQL SUCCESS, SonarCloud SUCCESS, agent-shield SUCCESS, dependency-audit jobs SUCCESS/SKIPPED. No failing checks. Already approved by donpetry-bot.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.