SonarCloud: S7635 secrets-inherit caller stubs

[don-petry]

SonarCloud: S7635 secrets-inherit caller stubs

5 open SonarCloud finding(s) in petry-projects/markets, worst severity MAJOR. Generated by the org SonarCloud Audit.

View in SonarCloud →

Findings

Rule	Count	Representative message
githubactions:S7635	5	Only pass required secrets to this workflow.

Affected files

• .github/workflows/auto-rebase.yml (1)
• .github/workflows/dependabot-automerge.yml (1)
• .github/workflows/dev-lead.yml (1)
• .github/workflows/pr-review-mention.yml (1)
• .github/workflows/pr-review.yml (1)

Priority

Labeled priority:major — mapped from this bucket's worst SonarCloud severity (MAJOR).

Acceptance

• All findings in this workstream resolved to zero in SonarCloud
• No behavior change; CI green
• Real fixes (no blanket NOSONAR unless a confirmed false positive, noted inline)

---

Idempotent issue — updated automatically each audit run; auto-closed when the finding count reaches zero.

[don-petry]

Dev-Lead Implementation Plan

Issue: #313 — SonarCloud: S7635 secrets-inherit caller stubs

Scope

Replace secrets: inherit in all 5 flagged caller-stub workflows with explicit secrets: blocks that pass only the secrets each reusable workflow declares under on.workflow_call.secrets — the same fix already applied to the sibling stubs in this repo (dependabot-rebase.yml, pr-auto-review.yml, ci-failure-analyst.yml, add-to-project.yml, feature-ideation.yml). No behavior change: the exact set of secrets each reusable consumes is forwarded, just enumerated instead of inherited.

Secret sets were verified against each reusable's workflow_call.secrets declaration (public petry-projects/.github and private petry-projects/.github-private).

Implementation Checklist

• .github/workflows/auto-rebase.yml → GH_PAT_WORKFLOWS (reusable declares it, optional; used to push workflow-file branch updates GITHUB_TOKEN can't)
• .github/workflows/dependabot-automerge.yml → APP_ID, APP_PRIVATE_KEY (both required); update stale "MUST NOT change secrets: inherit" header note
• .github/workflows/dev-lead.yml → CLAUDE_CODE_OAUTH_TOKEN (required) + GH_PAT_WORKFLOWS, GOOGLE_API_KEY, GH_PAT (optional)
• .github/workflows/pr-review-mention.yml → GH_PAT_WORKFLOWS, DON_PETRY_BOT_GH_PAT (both required); update header note
• .github/workflows/pr-review.yml → CLAUDE_CODE_OAUTH_TOKEN, GOOGLE_API_KEY, COPILOT_GITHUB_TOKEN, DON_PETRY_BOT_GH_PAT, DON_PETRY_BOT_GH_PAT_CLASSIC, GH_PAT (all declared, optional); update header note

Tests to Write

• TDD Phase 2 exception invoked: behavior-preserving CI-config change with no observable runtime behavior to unit-test. Validation is via YAML parse + linters instead.
• Verify each file still parses as valid YAML (python yaml.safe_load)
• Run yamllint on the 5 changed files
• Confirm no remaining secrets: inherit in the repo's workflows

Test Command

python3 -c "import yaml,glob; [yaml.safe_load(open(f)) for f in glob.glob('.github/workflows/*.yml')]" + yamllint .github/workflows/{auto-rebase,dependabot-automerge,dev-lead,pr-review-mention,pr-review}.yml + bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Implementation Complete

Replaced secrets: inherit with explicit secrets: mappings in all 5 flagged caller-stub workflows (SonarCloud githubactions:S7635). Each mapping passes exactly the secrets the corresponding reusable workflow declares under on.workflow_call.secrets — verified against the source (petry-projects/.github and petry-projects/.github-private). This is the same pattern already adopted by sibling stubs in this repo (dependabot-rebase.yml, pr-auto-review.yml, ci-failure-analyst.yml, add-to-project.yml, feature-ideation.yml). No behavior change: the exact set of consumable secrets is still forwarded, just enumerated instead of inherited.

Plan Execution

• auto-rebase.yml → GH_PAT_WORKFLOWS (reusable-declared, optional)
• dependabot-automerge.yml → APP_ID, APP_PRIVATE_KEY (both required) + updated stale header note
• dev-lead.yml → CLAUDE_CODE_OAUTH_TOKEN (required) + GH_PAT_WORKFLOWS, GOOGLE_API_KEY, GH_PAT (optional)
• pr-review-mention.yml → GH_PAT_WORKFLOWS, DON_PETRY_BOT_GH_PAT (both required) + updated header
• pr-review.yml → CLAUDE_CODE_OAUTH_TOKEN, GOOGLE_API_KEY, COPILOT_GITHUB_TOKEN, DON_PETRY_BOT_GH_PAT, DON_PETRY_BOT_GH_PAT_CLASSIC, GH_PAT (all declared, optional) + updated header

TDD Note

Phase 2 test-first was invoked under the documented exception: this is a behavior-preserving CI-configuration change with no observable runtime behavior to unit-test. Validation was performed via YAML parsing, yamllint, and the repo lint script instead.

Test / Validation Results

$ python3 -c "yaml.safe_load each .github/workflows/*.yml"
all parse OK

$ grep -rn "secrets: inherit" .github/workflows/
(none in the 5 target files — only match is an explanatory comment in add-to-project.yml)

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck: no .sh files found — skipping
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed
lint exit: 0

(yamllint is not a repo CI gate and has no config; its only findings are pre-existing line-length/EOF style notes. The no-trailing-newline convention was preserved to match the sibling caller stubs.)

Files Changed

• .github/workflows/auto-rebase.yml: explicit GH_PAT_WORKFLOWS
• .github/workflows/dependabot-automerge.yml: explicit APP_ID + APP_PRIVATE_KEY; header note updated
• .github/workflows/dev-lead.yml: explicit 4-secret block (1 required + 3 optional)
• .github/workflows/pr-review-mention.yml: explicit GH_PAT_WORKFLOWS + DON_PETRY_BOT_GH_PAT; header note updated
• .github/workflows/pr-review.yml: explicit 6-secret block (all declared optional); header note updated

Notes

• No blanket NOSONAR used — these are real fixes. The existing # NOSONAR(githubactions:S7637) comments on the uses: lines are unrelated (SHA-pinning rule) and were left untouched.
• Secret sets were taken from each reusable's actual workflow_call.secrets declaration, so optional secrets that were previously reachable via inherit remain reachable — zero behavior change.
• These stubs are centrally-sourced. If the upstream source-of-truth still emits secrets: inherit, a future adoption sync could reintroduce it; the org has already migrated the sibling stubs, so upstream is expected to follow. No follow-up issue opened.

[don-petry]

SonarCloud Audit (2026-07-14): still open — 5 finding(s), worst severity MAJOR.