feat: implement issue #331 — { "message": "API rate limit exceeded for user ID 36422719. If you reach out to GitHub Support for help, please include the request ID 0401:3AC036:3A21F13:CD1C249:6A5A3B10 and timestamp 2026-07-17 14:24:16 UTC. For more on scraping GitHub and how it may affect your rights, please review our Terms of Service (https:\/\/docs.github.com\/en\/site-policy\/github-terms\/github-terms-of-service)", "documentation_url": "https://docs.github.com/en/rest/using-the-rest-api/getting-started-with-the-rest-api#rate-limiting", "status": "403" } Unknown

[don-petry]

Closes #331

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 5 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0672b05c-5b75-40fc-a730-49d710eed29f

📥 Commits

Reviewing files that changed from the base of the PR and between 8e2a986 and 12672e1.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-331-20260717-1424

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[Copilot]

Pull request overview

This PR addresses compliance issue #331 by re-syncing the .github/workflows/pr-auto-review.yml caller stub’s on.workflow_run.workflows list to match the org standard template, ensuring the PR auto-review ready check triggers as expected.

Changes:

• Narrowed workflow_run.workflows to ["CI"] in the PR Auto-Review caller stub to align with the canonical petry-projects/.github/standards/workflows/pr-auto-review.yml.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: []
Notes: Quality gate passed. No code changes needed.
```
The PR is ready to merge from a code quality perspective.

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 12672e1b955475b5e223b692d2165fd2342a0fbb
Review mode: triage-approved (single reviewer)

Summary

This PR narrows the pr-auto-review.yml caller stub's workflow_run.workflows trigger from ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"] to ["CI"], in response to compliance finding #331 ("stub-surface-drift-pr-auto-review.yml-on"). The change is mechanically what the issue asked for, but it conflicts with the canonical template's own documented rules and introduces a functional regression, so it is escalated for human review despite triage clearing it as low-risk.

Linked issue analysis

Issue #331 (compliance audit) claims the stub's on: surface is "owned centrally and not repo-adjustable" and demands a re-sync from standards/workflows/pr-auto-review.yml. However, the canonical template's header explicitly states: "You MAY change: the workflow name(s) in workflow_run.workflows to match your repository's CI workflow name(s)", and the template carries a TODO: replace "CI" with your repository's CI workflow name(s) — i.e. ["CI"] is a placeholder, not the mandated value. The removed entries ("SonarCloud Analysis", "Dev-Lead Agent", "CodeQL") are all real GitHub Actions workflows in this repo (confirmed via the PR's own status rollup), so the previous list was exactly the customization the template permits. The audit rule and the template contradict each other; the correct remediation may be to fix the audit check (or mark the finding as a false positive), not to revert the stub to the placeholder.

Findings

1. [MEDIUM — blocking] Functional regression in auto-review triggering. workflow_run only fires for the named GitHub Actions workflows, and check_suite does not fire for GitHub Actions runs (per the comment in this very file). After this change, when "CodeQL", "SonarCloud Analysis", or "Dev-Lead Agent" is the last workflow to complete on a PR, the readiness check will not be re-evaluated — auto-review can silently stall on such PRs.
2. [MEDIUM — blocking] Compliance finding vs. canonical template contradiction. The issue asserts on: is not repo-adjustable; the template header explicitly permits adjusting workflow_run.workflows. A human (org-leads) should decide which is authoritative before merging a change that reverts a documented, permitted customization. (The issue's remediation template list doesn't even include pr-auto-review.yml, further suggesting the audit tooling is misconfigured.)
3. [LOW] Malformed PR title / commit message. The title and commit message contain a leaked GitHub API 403 rate-limit error JSON blob instead of the issue title ("feat: implement issue Compliance: stub-surface-drift-pr-auto-review.yml-on #331 — { "message": "API rate limit exceeded…" }"). This should be reworded before merge; it also indicates the dev-lead agent pipeline ingested an API error into its metadata.
4. Secret scanning: the run_secret_scanning MCP tool was not available in this environment; the gitleaks CI check passed. No secrets are present in the one-line diff.

CI status

All checks green: CI (ecosystem detect + gitleaks) ✓, CodeQL ✓, SonarCloud (quality gate passed, 0 new issues) ✓, AgentShield ✓, dependency-audit ✓, pr-auto-review ready-check ✓. Remaining jobs skipped by design. Merge state is BLOCKED pending required review (org-leads).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Closing as part of the 50-PR cap drain. The dev-lead fix-loop repairs #1340 (self-cancellation), #1290 (comment-inertness) and #806 (thread-resolution) have all landed, so this deadlocked PR can be regenerated cleanly through the repaired loop. The driving issue stays open and its dev-lead label is re-fired — no work is lost.