security: pin reusable PR autofix scheduler source

[seonghobae]

Security gap

The reusable PR review-fix scheduler was referenced by caller repositories at an immutable workflow SHA, but its checkout step loaded scheduler code from main. GitHub documents that the ordinary github context in a reusable workflow belongs to the caller; the called-workflow source is exposed through the job workflow context.

Change

• remove the caller-selectable canonical_ref input
• check out job.workflow_repository at immutable job.workflow_sha
• keep checkout credentials non-persistent
• add regression tests preventing caller-controlled or branch-selected trusted source
• retain the scheduler's bounded dispatch and least-privilege token contract

Verification required

• central Python tests and 100% coverage/docstrings
• required security/review workflows on the exact head
• caller workflow update only after this PR merges and its merge SHA can be pinned

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 8 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1c89f5a8-790f-4f78-b28b-39834f6c8aea

📥 Commits

Reviewing files that changed from the base of the PR and between 5983b41 and da7570c.

📒 Files selected for processing (2)

• .github/workflows/pr-review-fix-scheduler.yml
• tests/test_pr_review_fix_scheduler_source_pin.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #704. The hourly scheduler PR now includes this immutable called-workflow source binding, removes canonical_ref, adds the same supply-chain regression contract, and preserves the bounded one-dispatch cadence in a single non-conflicting change. Closing this duplicate avoids two overlapping edits to the same privileged workflow.