chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

[don-petry]

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

• pr-review-mention.yml
• dev-lead.yml
• agent-shield.yml
• auto-rebase.yml
• dependabot-automerge.yml
• dependabot-rebase.yml
• dependency-audit.yml
• add-to-project.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 54 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6c45ba97-8893-47ed-9c77-e1b7cbb5551a

📥 Commits

Reviewing files that changed from the base of the PR and between 61644d9 and 4b29c29.

📒 Files selected for processing (8)

• .github/workflows/add-to-project.yml
• .github/workflows/agent-shield.yml
• .github/workflows/auto-rebase.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/dependabot-rebase.yml
• .github/workflows/dependency-audit.yml
• .github/workflows/dev-lead.yml
• .github/workflows/pr-review-mention.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch standards-sync/workflows-20260713

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 4b29c2923ec95dc8fdd943363c40b1c39790e07d
Review mode: triage-approved (single reviewer)

Summary

Automated standards-sync PR from scripts/deploy-standard-workflows.sh updating 8 thin-caller workflow stubs. Six stubs bump their reusable-workflow channel pin from <name>/stable to <name>/v2-stable; dev-lead.yml moves to dev-lead/v1-stable (uses: ref + agent_ref, kept consistent); add-to-project.yml drops the discussion trigger and its concurrency branch (Ideas no longer tracked here); pr-review-mention.yml drops the job-level bot-sender guard (org source of truth no longer carries it, presumably absorbed by the v2 reusable). Remaining changes are header-comment updates and trailing-newline fixes. Verified independently: every stub at $PR_HEAD_SHA is byte-identical to petry-projects/.github/standards/workflows/ except for the per-repo channel pin, which the stub headers explicitly document as the only permitted per-repo variance; all 7 referenced channel tags (6 in petry-projects/.github, dev-lead/v1-stable in petry-projects/.github-private) exist. No new permissions, no new triggers, no secret handling changes (explicit secret pass-through and pre-existing secrets: inherit unchanged).

Linked issue analysis

No linked issues — expected for automated standards-sync PRs. The PR body documents the source (petry-projects/.github standards/workflows/), the deploy mechanism, and references the governing standard (standards/ci-standards.md). Tracking refs (.github#387, #415) are noted in the stub headers.

Findings

• Triage assessment confirmed: routine standards sync, verbatim modulo the documented channel-pin substitution.
• Channel tags verified to exist: agent-shield/v2-stable, auto-rebase/v2-stable, dependabot-automerge/v2-stable, dependabot-rebase/v2-stable, dependency-audit/v2-stable, pr-review-mention/v2-stable, dev-lead/v1-stable — no risk of a dangling-ref workflow failure.
• pr-review-mention.yml removes the if: github.event.sender.type != 'Bot' guard. This matches the org source of truth, so it is an intentional org-level change (guard expected to live in the v2 reusable), not drift — noting for visibility only.
• Moving channel tags instead of SHA pins are an accepted, documented org pattern (NOSONAR first-party channel-ref markers present).
• Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed and the diff contains no credential-like content.

CI status

All checks green: CodeQL (actions) SUCCESS, SonarCloud Quality Gate passed (0 new issues, 0 hotspots), gitleaks secret scan SUCCESS, AgentShield SUCCESS, add-to-project SUCCESS, dev-lead dispatch SUCCESS (review-changes: no-changes), CodeRabbit status SUCCESS. Remaining checks SKIPPED by design (ecosystem-gated audits, backend/frontend CI, dependabot jobs). mergeable: MERGEABLE; BLOCKED state reflects only the pending review requirement.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[donpetry-bot]

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-13T12:46:32Z.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 4b29c2923ec95dc8fdd943363c40b1c39790e07d
Review mode: triage-approved (single reviewer)

Summary

Automated standards-sync PR (opened by scripts/deploy-standard-workflows.sh) updating 8 thin-caller workflow stubs. Six stubs bump their reusable-workflow channel pin from /stable to /v2-stable; dev-lead.yml moves to dev-lead/v1-stable (uses: ref and agent_ref kept consistent); add-to-project.yml drops the discussion trigger and its concurrency branch (Ideas now live in Discussions and are not tracked); pr-review-mention.yml drops the job-level bot-sender guard, matching the org source of truth (guard absorbed by the v2 reusable). Remaining changes are header-comment updates and trailing-newline fixes. Independently verified: every stub at the head SHA is byte-identical to petry-projects/.github/standards/workflows/ except the per-repo channel pin, which the stub headers document as the only permitted variance. All 7 referenced channel tags exist. No new permissions, no new triggers, no secret-handling changes (explicit secret pass-through and pre-existing secrets: inherit unchanged).

Linked issue analysis

No linked issues — expected for automated standards-sync PRs. The PR body documents the source (petry-projects/.github standards/workflows/), the deploy mechanism, and the governing standard (standards/ci-standards.md). Tracking refs (.github#387, #415) are noted in the stub headers.

Findings

• Triage assessment confirmed: routine standards sync, verbatim modulo the documented channel-pin substitution.
• Byte-level verification: all 8 stubs identical to the org source of truth except the uses:/agent_ref channel pins (stable → v2-stable / v1-stable), the sole documented per-repo variance.
• Channel tags verified to exist: agent-shield/v2-stable, auto-rebase/v2-stable, dependabot-automerge/v2-stable, dependabot-rebase/v2-stable, dependency-audit/v2-stable, pr-review-mention/v2-stable (petry-projects/.github) and dev-lead/v1-stable (petry-projects/.github-private) — no dangling-ref risk.
• pr-review-mention.yml removes the job-level 'if: github.event.sender.type != Bot' guard. This matches the org source of truth, so it is an intentional org-level change, not drift — noted for visibility only.
• Moving channel tags instead of SHA pins are the accepted, documented org pattern (NOSONAR first-party channel-ref markers present on every uses: line).
• Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed and the diff contains no credential-like content.
• A prior single-reviewer approval already exists at this same head SHA; this run independently re-verified and reached the same conclusion.

CI status

All checks green: CodeQL (actions) SUCCESS, SonarCloud Quality Gate passed (0 new issues, 0 hotspots), Secret scan (gitleaks) SUCCESS, AgentShield SUCCESS, add-to-project SUCCESS, dev-lead dispatch SUCCESS (review-changes: no-changes), pr-auto-review check SUCCESS, CodeRabbit status SUCCESS. Remaining checks SKIPPED by design (ecosystem-gated audits, Backend/Frontend CI, dependabot-only jobs).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.