feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

[don-petry]

User description

Closes #301

Implemented by dev-lead agent. Please review.

---

CodeAnt-AI Description

Route feature ideation through the stable workflow and clarify token setup errors

What Changed

• Feature ideation now uses the stable reusable workflow channel
• Missing-token errors identify both supported personal access tokens

Impact

✅ More reliable feature ideation runs
✅ Clearer workflow setup errors

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Chores
  • Updated workflow validation to support either of the approved authentication secrets.
  • Updated the reusable feature-ideation workflow reference.
  • Excluded the .dev-lead/ working directory from version control.
• Documentation
  • No user-facing documentation changes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1cba0db4-3ff9-4010-bfdc-38a8d601263d

📥 Commits

Reviewing files that changed from the base of the PR and between c58ab42 and f8318c8.

📒 Files selected for processing (1)

• .gitignore

📝 Walkthrough

Walkthrough

The pull request updates the feature-ideation workflow error message and reusable workflow reference. It adds .dev-lead/ to .gitignore. The project secret mapping and README contribution agreement remain unchanged.

Changes

Workflow and repository updates

Layer / File(s)	Summary
Feature-ideation workflow alignment .github/workflows/feature-ideation.yml, .github/workflows/add-to-project.yml	The missing-token error names both accepted PAT secrets. The reusable workflow reference uses feature-ideation/stable. The existing private-key secret mapping remains unchanged.
Repository housekeeping .gitignore, README.md	The repository ignores .dev-lead/. The contribution agreement statement remains unchanged.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• petry-projects/markets#78: Both PRs update the reusable workflow reference in .github/workflows/feature-ideation.yml.
• petry-projects/markets#350: Both PRs modify the redispatch logic and reusable workflow reference.

Suggested reviewers: donpetry-bot

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The workflow uses feature-ideation/stable, but issue #301 requires the canonical stub that delegates to the reusable workflow at @v1.	Replace the workflow with the canonical standards template and verify that the reusable workflow reference ends with @v1.
Out of Scope Changes check	⚠️ Warning	The .gitignore change for .dev-lead/ and unrelated no-op edits are outside issue #301's feature-ideation workflow scope.	Remove unrelated .gitignore, add-to-project workflow, and README changes from this pull request.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the implementation of issue #301 and the feature-ideation workflow compliance change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-301-20260721-1923

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Updates the repo’s centralized feature-ideation.yml workflow stub to match the latest org “thin caller” pattern, including bridging discussion:created events into a supported workflow_dispatch execution path.

Changes:

• Adds a redispatch job to re-trigger the workflow under workflow_dispatch when an “Ideas” discussion is created.
• Adds a prep job to resolve dispatch/schedule inputs into needs.prep.outputs.*, avoiding inputs usage in the reusable with: block.
• Updates the reusable workflow reference and expands supported workflow_dispatch inputs (enhance_backlog, target_discussion).

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #351
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-08-07T00:12:57Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-08-07T00:12:57Z

[coderabbitai]

🧹 Nitpick comments (1)

.gitignore (1)

418-420: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove the duplicate .dev-lead/ entry.

.dev-lead/ already appears at Line 389. Keep one entry. Move the comment beside the existing rule if the comment is needed.

Proposed fix

-# Dev-lead agent working directory
-.dev-lead/

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.gitignore around lines 418 - 420, Remove the duplicate .dev-lead/ ignore
rule from the later section of .gitignore, retaining the existing entry and
moving the “Dev-lead agent working directory” comment beside it if needed.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.gitignore:
- Around line 418-420: Remove the duplicate .dev-lead/ ignore rule from the
later section of .gitignore, retaining the existing entry and moving the
“Dev-lead agent working directory” comment beside it if needed.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ef7c2035-773f-4797-9c53-e21ddf613aac

📥 Commits

Reviewing files that changed from the base of the PR and between e80f9af and c58ab42.

📒 Files selected for processing (4)

• .github/workflows/add-to-project.yml
• .github/workflows/feature-ideation.yml
• .gitignore
• README.md

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 1 thread:
- Thread PRRT_kwDORntvTc6Ss3AJ: skipped — first-party channel ref (@feature-ideation/stable),
  guardrail prohibits pinning; NOSONAR(githubactions:S7637) suppression already in place.
  Bot thread → replied + resolved.
Test verification: pass — no code changes; all CI checks already green.
Files changed: none
```

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: f8318c8f0de72f3093869a8a0ee07b83adc137c8
Review mode: triage-approved (single reviewer)

Summary

XS PR (+5/−4, 4 files) implementing compliance issue #301. Core change: the feature-ideation.yml thin-caller stub now delegates to the reusable via the org-standard moving channel tag @feature-ideation/stable (was @feature-ideation/v1-stable), matching ci-standards.md §centralization-tiers, which mandates uses: …/<name>-reusable.yml@<name>/stable with the NOSONAR(S7637) first-party suppression (retained). The token-guard error message was corrected to name both accepted PATs (GH_PAT_DON_PETRY or GH_PAT_WORKFLOWS), matching the actual GH_TOKEN fallback expression. Remaining hunks are whitespace/EOF-newline residue from merge-conflict resolution (.gitignore, README.md, add-to-project.yml). Triage's low-risk assessment is confirmed.

Linked issue analysis

Issue #301 (compliance audit: non-stub-feature-ideation.yml) asked the stub to match the canonical template; its remediation text cited an outdated @v1 pin. The current org standard (ci-standards.md, centralization tiers + reusable-workflow versioning) specifies the moving @<name>/stable channel tag for stubs, which is exactly what this PR adopts. The repo owner confirmed this intent in review threads (channel tag is the release/rollback mechanism; pinning @v1 would break it). project_context — the one required per-repo customisation — is properly filled in. Issue #301 is closed. Substantively addressed.

Findings

• Resolved (owner-adjudicated): Copilot flagged the stable ref vs the issue's @v1 remediation text; owner replied ×4 that @feature-ideation/stable is the intentional first-party rolling channel per AGENTS.md/ci-standards.md, with the NOSONAR(S7637) suppression as the sanctioned remedy. Thread resolved; consistent with org standards as verified against ci-standards.md.
• Note (non-blocking): The stub's error-message line and uses: ref now differ from the canonical template file standards/workflows/feature-ideation.yml (which still shows v1-stable and the single-PAT message). Both PR-side values are more correct per current standards/behavior — consider upstreaming these two lines to the template so future verbatim copies don't regress.
• Nit (non-blocking): add-to-project.yml lost its trailing newline; .gitignore gained a trailing blank line — cosmetic conflict-resolution residue.
• Secret scan: MCP run_secret_scanning was not permitted in this run; gitleaks CI check passed and no secret material appears in the diff (only an unchanged secrets-mapping line differing by EOF newline).
• All 4 review threads resolved; no unanswered human-reviewer questions.

CI status

All required checks green: AgentShield ✓, CodeQL ✓, SonarCloud ✓, Secret scan (gitleaks) ✓, Graphite AI ✓, CodeRabbit ✓, pr-auto-review dispatch ✓. Conditional jobs skipped as expected (ecosystem audits, Backend/Frontend CI — no matching files). review / review shows CANCELLED — that is a superseded run of this review pipeline itself, not a product CI failure. Mergeable; merge state BLOCKED only pending review approval.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.