feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml

[don-petry]

Closes #368

Implemented by dev-lead agent. Please review.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ec2e23c8-229e-4af0-bc57-d88143622191

📥 Commits

Reviewing files that changed from the base of the PR and between c343975 and f5fe44f.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (10)

• .github/workflows/feature-ideation.yml
• apps/mobile/package.json
• apps/mobile/tsconfig.json
• package.json
• packages/config/package.json
• packages/domain-types/package.json
• packages/graphql-types/package.json
• packages/test-utils/package.json
• packages/ui/package.json
• pnpm-workspace.yaml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-368-20260715-0238

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates Broodly’s .github/workflows/feature-ideation.yml to align with the centralized org “thin stub” workflow pattern for Feature Ideation, addressing the compliance finding referenced in #368. The workflow now matches the current upstream standards template structure while keeping repo-specific customization in project_context.

Changes:

• Adds the redispatch bridge to handle discussion:created events by re-invoking the workflow via workflow_dispatch (avoids unsupported discussion contexts).
• Adds a prep job to safely resolve inputs and pass them into the reusable workflow via needs.prep.outputs.*.
• Updates the reusable workflow callsite to use the upstream “channel ref” (@feature-ideation/stable) and wires in enhance_backlog / target_discussion inputs.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #397
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-15T03:32:54Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-15T03:32:54Z

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: f5fe44f8ee987151af8e77eee9ae660927e9be27
Review mode: triage-approved (single reviewer)

Summary

Replaces .github/workflows/feature-ideation.yml with the canonical org thin-caller stub (verified byte-for-byte against petry-projects/.github standards/workflows/feature-ideation.yml, with only the sanctioned project_context customisation), resolving compliance finding #368. Follow-on commits fix CI: pnpm 9→11 packageManager bump, overrides moved from package.json to pnpm-workspace.yaml (security floors preserved), @types/jest added to apps/mobile, and no-op jest test scripts removed from five test-less type/util packages.

Linked issue analysis

Issue #368 (compliance audit: non-stub-feature-ideation.yml) requires copying the canonical template from standards/workflows/ verbatim. Verified: the file at the PR head SHA is identical to the current upstream template except for the project_context value, which the template header explicitly designates as the one required per-repo edit. The issue text mentions @v1 pinning, but the authoritative remediation is the template itself, which uses the first-party @feature-ideation/stable channel ref (with its NOSONAR annotation). Substantively addressed.

Findings

• Workflow security: new redispatch and prep jobs declare permissions: {} and pass event-derived values (discussion number, dispatch inputs) via env vars, not inline interpolation — no script-injection surface. GH_PAT_WORKFLOWS usage matches the org template. CodeQL (actions) and SonarCloud pass.
• Unpinned reusable ref (@feature-ideation/stable) is the org-standard first-party channel ref taken verbatim from the template; not a violation.
• pnpm-workspace.yaml overrides: shell-quote duplicate removed (ranged override retained); tmp/uuid overrides broadened from ranged to unconditional floors — security constraints preserved or strengthened. pnpm audit passes.
• Secret scan: run_secret_scanning MCP tool not available in this environment; gitleaks CI check passed and no literal credentials appear in the diff (packageManager sha512 is an integrity hash).
• Minor (non-blocking): the pnpm 9→11 bump and test-script removals are scope creep relative to #368, but were required to get CI green and are well-explained in commit messages. Removing test scripts from the five packages means future test files there would need the script restored.
• Triage assessment confirmed: no issues missed that would change the outcome; risk set to MEDIUM (workflow + dependency tooling changes) rather than LOW.

CI status

All required checks green at f5fe44f: CI (TypeScript, Go, gitleaks), CodeQL (actions/go/javascript-typescript), SonarCloud quality gate, AgentShield, dependency-audit (pnpm audit, govulncheck; others skipped), CodeRabbit status SUCCESS. Remaining SKIPPED checks are conditional (dependabot, cargo/pip audit, image push). mergeStateStatus BLOCKED solely on the pending review requirement.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.