ci: pin dependency-audit reusable workflow to SHA (closes #87)

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/dependency-audit-reusable.yml from @v1 to its full commit SHA to satisfy the org-level action-pinning policy.
• SHA resolved via gh api repos/petry-projects/.github/git/refs/tags/v1 → ee22b427cbce9ecadcf2b436acb57c3adf0cb63d

uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1

Standard: ci-standards.md#action-pinning-policy

Closes #87

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 49 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7e0333e4-0d90-40bf-bb75-1337dd86d093

📥 Commits

Reviewing files that changed from the base of the PR and between cd18d3d and 07a2604.

📒 Files selected for processing (1)

• .github/workflows/dependency-audit.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-87-20260418-1841

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — you're the CODEOWNER for this repository. This PR pins the dependency-audit-reusable.yml reusable workflow reference to its full commit SHA to resolve the compliance finding in issue #87.

Change summary: One line in .github/workflows/dependency-audit.yml — @v1 → @ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1. SHA was resolved directly from the v1 tag ref via the GitHub API.

Please review and merge when ready.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Pins the dependency-audit reusable workflow reference to an immutable commit SHA to comply with the org action-pinning policy.

Changes:

• Update the uses: reference from @v1 to a full commit SHA for the reusable workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Superseded by automated re-review at a10685acc967a1ad8ad6d63fec9d85210f88d731 — click to expand prior review.

Automated review — APPROVED

Risk: LOW
Reviewed commit: 02a5c3f2f5fff655b086a8ce07d439d24ac70e8e
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Single-line GitHub Actions workflow change that pins a reusable workflow reference from the mutable @v1 tag to its immutable commit SHA (ee22b427), satisfying the org-level action-pinning policy from issue #87. The SHA was independently verified against the v1 tag ref in petry-projects/.github and matches exactly. All CI checks pass (CodeQL, SonarCloud, AgentShield) with no security findings.

Findings

Info

• [info] .github/workflows/dependency-audit.yml:33 — SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d confirmed to match the v1 tag in petry-projects/.github via API verification — change is correct and safe. (supply-chain)
• [info] All CI checks passed: CodeQL (actions), SonarCloud (0 issues, 0 hotspots), AgentShield, Dependency audit, Claude Code. No failures or warnings. (ci-status)
• [info] .github/workflows/dependency-audit.yml:33 — Change correctly resolves issue Compliance: unpinned-actions-dependency-audit.yml #87 (org action-pinning policy compliance). Mutable tag reference replaced with pinned SHA plus inline comment preserving the semantic version. (compliance)

CI status

All CI checks passed: CodeQL, SonarCloud (0 issues, 0 hotspots), AgentShield, Dependency audit, Claude Code.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: a6a83ffb7b99f604dd608a6bb643f9fa1ac9fe0e
Review mode: triage-approved (single reviewer)

Summary

PR #104 adds a single idempotent bash script (.github/scripts/apply-repo-settings.sh, 48 lines) that enforces org-standard repository settings via gh api -X PATCH. This directly resolves compliance issue #90 (delete_branch_on_merge must be true). No production code is changed — the script is a manual admin tool requiring an explicit GH_TOKEN with admin scope at runtime. No substantive code changes since the prior cascade review (only merge commits and a CI retrigger).

Linked issue analysis

• Closes #90 — Compliance audit flagged delete_branch_on_merge as null (expected true). The script sets delete_branch_on_merge=true along with all other org-standard defaults. The setting was also applied directly via the API per the PR description. Issue is substantively addressed.

Findings

No blocking issues. Minor observations (informational only, not blocking):

• [info] -F (typed field) is used for string enum values like squash_merge_commit_title=PR_TITLE. The gh CLI handles this correctly, though -f (raw string) would be slightly more self-documenting for non-boolean/non-numeric values.
• [info] REPO is hardcoded to petry-projects/markets. This is intentional and appropriate for a compliance-enforcement script scoped to this repository.

CI status

All checks passed:

• ✅ CodeQL (actions) — SUCCESS
• ✅ SonarCloud — SUCCESS (0 new issues, 0 security hotspots)
• ✅ AgentShield — SUCCESS
• ✅ CodeRabbit — SUCCESS
• ✅ Dependency audit — ecosystem detection SUCCESS, language-specific audits SKIPPED (no applicable ecosystems)
• ✅ CI — ecosystem detection SUCCESS, Backend/Frontend SKIPPED (no changes to those layers)

---

Reviewed automatically by the don-petry PR-review agent (single-reviewer, triage-approved). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: e0886512c9fdfd51836fcf070403a0d6b1fbc7bd
Review mode: triage-approved (single reviewer)

Summary

Single-file GitHub Actions workflow change adopting the org-standard dependabot-rebase caller stub. Pins the reusable workflow to SHA 3c6335c0 (replacing mutable @v1 tag), replaces blanket secrets: inherit with explicit APP_ID/APP_PRIVATE_KEY, adds workflow_dispatch trigger, and escalates job permissions from read to write (justified by rebase and re-approve operations). Net security posture is improved.

Linked issue analysis

No linked issues. PR description states it supersedes prior SHA-pinning and dispatch PRs — this is a standards-adoption change with self-contained motivation.

Findings

No blocking issues.

Positive changes:

• Reusable workflow ref changed from mutable tag @v1 to SHA-pinned @3c6335c0a214bba940bbcbc4346e9d4ab0cb63e1 — prevents tag-hijack supply-chain risk.
• secrets: inherit (passes all repo secrets) replaced with explicit APP_ID / APP_PRIVATE_KEY — reduces secret surface area.

Informational:

• Permission escalation from contents: read / pull-requests: read to contents: write / pull-requests: write — necessary for the reusable workflow to update branches and re-approve PRs post-rebase. Inline comments document the rationale. Blast radius is limited by the SHA-pinned reusable ref.
• workflow_dispatch trigger added — allows manual flush of the Dependabot PR queue. Low risk.

CI status

All checks passed:

• ✅ CodeQL (actions) — SUCCESS
• ✅ SonarCloud — SUCCESS (0 new issues, 0 security hotspots)
• ✅ AgentShield — SUCCESS
• ✅ CodeRabbit — SUCCESS
• ✅ Dependency audit — ecosystem detection SUCCESS
• ✅ CI — ecosystem detection SUCCESS

---

Reviewed automatically by the don-petry PR-review agent (single-reviewer mode: opus 4.6). Reply with @don-petry if you need a human.

Superseded by automated re-review at a10685a.

[petry-projects-pr-review-agent]

Automated review — human attention needed

This PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops.

Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the needs-human-review label and the cascade can be re-engaged on the next push.

Posted by the don-petry PR-review cascade.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.