feat: implement issue #495 — SonarCloud: miscellaneous findings

[don-petry]

User description

Closes #495

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Automated review workflows now monitor CI, unit tests, coverage, UI tests, security checks, and dependency audits.
  • Review processing is triggered consistently as each supported validation workflow completes.
  • This provides broader and more reliable coverage of automated checks before changes are reviewed.

---

CodeAnt-AI Description

Keep pull request review readiness up to date as all required checks finish

What Changed

• Readiness checks now re-evaluate when the AgentShield or Dependency audit workflows complete
• Review status continues to update after the repository’s main CI, tests, coverage, and UI test workflows finish

Impact

✅ Fewer stale PR readiness results
✅ Reviews update after security and dependency checks complete

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	b1906ff	Aug 02, 2026 · 01:45	01:45
✅ Reviewed your PR	cbc6001	Jul 28, 2026 · 18:52	18:52

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

📝 Walkthrough

Walkthrough

The auto-review workflow now triggers after six named CI and security workflows instead of only the CI workflow.

Changes

Workflow updates

Layer / File(s)	Summary
Auto-review workflow trigger .github/workflows/pr-auto-review.yml	The workflow_run trigger now monitors CI Pipeline, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, and Dependency audit.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• petry-projects/google-app-scripts#146: Adds the AgentShield workflow monitored by this configuration.
• petry-projects/google-app-scripts#507: Also modifies the workflow_run configuration in .github/workflows/pr-auto-review.yml.

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The workflow allowlist resolves the affected TODO with a real configuration fix and does not add NOSONAR suppression.
Out of Scope Changes check	✅ Passed	The changes are limited to the affected workflow and directly support the issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the SonarCloud issue addressed by the workflow change and accurately reflects the pull request objective.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-495-20260728-1849

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Align auto-review triggers with repository CI workflows

⚙️ Configuration changes 🕐 Less than 5 minutes

AI Description

• Trigger auto-review after each repository CI workflow completes.
• Remove the obsolete workflow placeholder and normalize YAML formatting.

Diagram

graph TD
  CI["CI Pipeline"] --> Event["Completion Event"] --> Caller["Auto-Review Caller"] --> Gate["Reusable Gate"]
  Node["Node.js Tests"] --> Event
  Coverage["Coverage"] --> Event
  UI["Playwright UI Tests"] --> Event

Loading

High-Level Assessment

Explicitly listing the repository's actual workflow names is the appropriate approach because GitHub Actions requires static names for workflow_run filters. Dynamic workflow discovery is unavailable, while changing the centralized reusable gate would unnecessarily affect other repositories.

Files changed (1) +3 / -3

Other (1) +3 / -3

pr-auto-review.ymlSubscribe auto-review to all repository CI workflows +3/-3

Subscribe auto-review to all repository CI workflows

• Replaces the placeholder CI workflow name with the four repository workflow names that should trigger readiness reevaluation. It also normalizes spacing before the inline Sonar suppression comment.

.github/workflows/pr-auto-review.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 20 rules

1. Required workflows omitted ✓ Resolved 🐞 Bug ≡ Correctness

Description

The new workflow_run allowlist omits the PR-triggered AgentShield and Dependency audit
workflows, whose jobs are designated as required status checks. Since check_suite does not trigger
for GitHub Actions runs, a PR may remain unprocessed when either omitted workflow is the final
required check to complete.

Code

.github/workflows/pr-auto-review.yml[R32-33]

+    workflows:
+      ['CI Pipeline', 'Node.js Tests', 'Coverage', 'Playwright UI Tests']

Relevance

●●● Strong

Prior review required actual readiness workflows; adding omitted required checks is a direct
correctness fix.

PR-#355

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The auto-review workflow states that workflow_run is necessary because check_suite does not
trigger for GitHub Actions, but its new allowlist excludes AgentShield and Dependency audit.
Both excluded workflows run on pull requests, and their documentation identifies their jobs as
required status checks; past PR #355 also established that this allowlist must contain the
repository's actual CI workflow names.

.github/workflows/pr-auto-review.yml[28-35]
.github/workflows/agent-shield.yml[12-26]
.github/workflows/dependency-audit.yml[18-24]
PR-#355

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The PR auto-review workflow does not listen for completion of all required GitHub Actions workflows. Add the exact top-level workflow names `AgentShield` and `Dependency audit` to `workflow_run.workflows` so readiness is re-evaluated when either completes.

## Issue Context
`check_suite` does not cover GitHub Actions workflow completions. Both omitted workflows run on pull requests and are documented as providing required status checks.

## Fix Focus Areas
- .github/workflows/pr-auto-review.yml[31-34]
- .github/workflows/agent-shield.yml[20-26]
- .github/workflows/dependency-audit.yml[18-24]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[donpetry-bot]

Superseded by automated re-review at b1906ff3ef03e3b312adfb0784b3a0d240ec1684 — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 24b4015f6e0dbb859fe26dbaf20d96d8880aa74a
Review mode: triage-approved (single reviewer)

Summary

Resolves SonarCloud S1135 by replacing the placeholder workflows: ["CI"] in pr-auto-review.yml with four real workflow names, plus prettier comment-spacing churn in three unrelated thin-caller stubs. The triage tier cleared this as low-risk, but confirmation review found the fix is incomplete (two required-check workflows omitted from the trigger allowlist) and the required CI checks never ran on the head commit, so the PR cannot be auto-approved.

Linked issue analysis

Closes #495 (SonarCloud S1135 — TODO comment in pr-auto-review.yml). The TODO is genuinely resolved with real workflow names and no new NOSONAR suppressions were added (existing ones only had spacing reformatted), so the SonarCloud finding itself is addressed. However, the issue's acceptance criteria require CI green, which is not met on the head commit (see CI status), and the chosen workflow list is incomplete (Finding 1).

Findings

1. [MEDIUM — blocking] workflow_run allowlist omits two required-check workflows. .github/workflows/pr-auto-review.yml now lists CI Pipeline, Node.js Tests, Coverage, and Playwright UI Tests, but omits AgentShield and Dependency audit. Verified at head SHA: both run on pull_request to main and their headers state their job names are required status checks (dependency-audit.yml explicitly says to add dependency-audit / Detect ecosystems to branch protection). Since check_suite does not fire for GitHub Actions runs (per the file's own comment), if either omitted workflow is the last required check to complete, the readiness gate never re-evaluates and the PR sits stale — the exact failure mode this trigger exists to prevent. This confirms Qodo's unresolved 'Action required' finding. Fix: add 'AgentShield', 'Dependency audit' to the list.
2. [MEDIUM — blocking] Required CI checks never ran on the head commit. Head 24b4015 is a chore(ci): apply prettier/eslint auto-fixes commit pushed by github-actions[bot] (GITHUB_TOKEN pushes do not trigger workflows). Check runs on the head SHA show only CodeQL, bots, and agent jobs — no CI Pipeline, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, or Dependency audit. CI cannot be considered green; mergeStateStatus is BLOCKED.
3. [LOW — note] Out-of-scope formatting churn. add-to-project.yml, auto-rebase.yml, dependabot-automerge.yml received comment-spacing-only changes from the repo's autofix job. Functionally harmless (no trigger/uses/permissions changes to the thin caller stubs), but CodeRabbit flagged the scope creep; ideally these would not ride along on an issue-scoped PR.
4. Secret scan: no secrets in the diff; the run_secret_scanning MCP tool was not available in this environment, so only manual + gitleaks/CodeQL coverage applies. dev-lead / dispatch and dev-lead / ci-relay show cancelled runs (agent orchestration, non-blocking).

CI status

Head SHA 24b4015: CodeQL (actions, js/ts, python) ✅, pr-auto-review ✅, CodeRabbit ✅, Graphite ✅. Missing entirely: CI Pipeline, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, Dependency audit — none triggered on the bot-pushed auto-fix commit. Dev-Lead Agent jobs: cancelled/skipped. SonarCloud quality gate passed (on prior commit cbc6001). Merge state: BLOCKED, review decision: REVIEW_REQUIRED. To re-trigger required checks, push an empty commit or close/reopen the PR.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #496
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-08-02T02:16:27Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-08-02T02:16:27Z

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-02T02:47:00Z.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
✓ No Tier 1 blockers exist. Quality Gate passed with 0 new issues and 0 security hotspots. No fixes required.
```

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: b1906ff3ef03e3b312adfb0784b3a0d240ec1684
Review mode: triage-approved (single reviewer)

Summary

Single-file workflow config change: replaces the placeholder workflow_run trigger ("CI" plus a TODO comment) in .github/workflows/pr-auto-review.yml with the repo's six real workflow names. All six names ('CI Pipeline', 'Node.js Tests', 'Coverage', 'Playwright UI Tests', 'AgentShield', 'Dependency audit') were verified against the repo's actual workflow list via the GitHub API — all match exactly. This resolves the SonarCloud S1135 (TODO) finding and the earlier qodo review finding about omitted required workflows.

Linked issue analysis

Closes #495 (SonarCloud: miscellaneous findings — 1 INFO finding, rule githubactions:S1135, a TODO comment in .github/workflows/pr-auto-review.yml). The diff removes the TODO comment and completes the task it described, which is a real fix (no NOSONAR suppression). SonarCloud quality gate passed on this PR, satisfying the issue's acceptance criteria.

Findings

• Triage assessment confirmed: LOW risk. The change touches only the workflow_run trigger list — no permissions, secrets, script blocks, or action pins are modified; no GitHub Actions security smells introduced.
• Prior review finding (qodo: required workflows AgentShield / Dependency audit omitted from the allowlist) is addressed by this commit — both are now included, and the review thread is resolved/outdated.
• Workflow-name correctness verified against the repo's live workflow list: all six trigger entries match actual workflow name: fields exactly.
• Secret scan: the run_secret_scanning MCP tool is not available in this run; gitleaks CI check passed and no secret-like content appears in the diff.
• No unresolved review threads and no unanswered human-reviewer questions.

CI status

All checks green: CI Pipeline (build-and-test), Node.js Tests, Coverage, Playwright UI Tests, AgentShield, dependency-audit (npm audit), CodeQL (actions/js-ts/python), SonarCloud quality gate, gitleaks secret scan, autofix, Graphite AI review — all SUCCESS. Remaining entries are SKIPPED ecosystem audits (pnpm/go/cargo/pip) and dependabot-automerge, which do not apply.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: b1906ff3ef03e3b312adfb0784b3a0d240ec1684
Review mode: triage-approved (single reviewer)

Summary

Replaces the placeholder workflow_run trigger list in .github/workflows/pr-auto-review.yml with the repository's six actual workflow names (CI Pipeline, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, Dependency audit), removing the associated TODO comment flagged by SonarCloud.

Linked issue analysis

Closes #495 (SonarCloud finding githubactions:S1135 — TODO comment in pr-auto-review.yml). The PR removes the TODO and substitutes the real workflow names, which is exactly the resolution the issue calls for. The issue is now closed and the SonarCloud quality gate passes on this PR.

Findings

• No security-relevant changes: no permissions modifications, no untrusted-input interpolation, no PR-code checkout — only the list of workflow names that re-trigger review readiness checks.
• Workflow names in the new list match the repository's CI checks observed on this PR (CI Pipeline/build-and-test, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, Dependency audit).
• Secret scan: gitleaks CI check passed; the run_secret_scanning MCP tool was unavailable in this environment (noted, non-blocking). No secret-like content in the diff.
• Triage assessment (low-risk) confirmed. The prior advisory-bot rate-limit hold has cleared: Qodo, CodeRabbit, CodeAnt, and SonarCloud all completed with no blocking findings.
• The single review thread is resolved (and outdated); no unanswered human-reviewer questions.

CI status

All required checks green at b1906ff3ef03e3b312adfb0784b3a0d240ec1684: build-and-test, Node.js Tests, Coverage, Playwright UI Tests, AgentShield, dependency-audit (npm audit), CodeQL (actions/js-ts/python), SonarCloud quality gate, Secret scan (gitleaks), autofix. Remaining entries are conditionally skipped ecosystem audits.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.