Fix org-wide failure of pr-review-mention reusable workflow caller (stale v1 tag)

[don-petry]

Problem

Every caller repo in petry-projects that uses the pr-review-mention.yml thin caller stub has been failing at parse time with:

error parsing called workflow: failed to fetch workflow: workflow was not found.

The caller stubs reference:

petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1

But the v1 lightweight tag in petry-projects/.github points at commit 0cb4bba11d7563bf197ad805f12fb8639e4879e4, which predates the existence of .github/workflows/pr-review-mention-reusable.yml. That file was first added on main on 2026-05-11 in commit a2b3b464... (PR #237 "feat: make pr-review-mention an org standard") and most recently updated on 2026-05-13 in commit d3d768dabb7f28cc63283cdfe48630da53700e50 (PR #266, @petry-review-bot → @donpetry-bot rename).

Verified: fetching the raw blob at the v1 ref returns 404; fetching at d3d768d returns the file. So @v1 is unresolvable for callers.

⚠️ There is an existing google-app-scripts PR #272 ("fix: pin pr-review-mention reusable workflow to SHA") that tries to pin to 0cb4bba1... — the same broken commit, just spelled as a SHA. DO NOT MERGE #272 AS-IS. It must be updated to the correct SHA or closed and superseded.

---

Scope — 5 files across 4 repos

Caller repos discovered via gh api search/code for the reusable path:

Repo	File
petry-projects/.github	.github/workflows/pr-review-mention.yml (dogfooded caller)
petry-projects/.github	standards/workflows/pr-review-mention.yml (template)
petry-projects/google-app-scripts	.github/workflows/pr-review-mention.yml
petry-projects/TalkTerm	.github/workflows/pr-review-mention.yml
petry-projects/bmad-bgreat-suite	.github/workflows/pr-review-mention.yml

---

Decisions

• Pin target SHA for every caller:
  d3d768dabb7f28cc63283cdfe48630da53700e50
  (latest commit on petry-projects/.github main containing the reusable)

• v1 tag in petry-projects/.github:
  Force-move it to d3d768d AND cut a new v2 tag at the same SHA.
  Moving v1 unbreaks production for any lagging caller immediately.
  v2 gives new adopters a clean semver tag to point at.

• Pin form in YAML (matches ci-standards.md action-pinning policy):

  uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # main

---

Execution Order

Step 1 — petry-projects/.github (do FIRST; unbreaks production)

a. Move the v1 tag to d3d768d:

gh api -X PATCH repos/petry-projects/.github/git/refs/tags/v1   -f sha=d3d768dabb7f28cc63283cdfe48630da53700e50 -F force=true

b. Cut a new v2 tag at d3d768d:

gh api -X POST repos/petry-projects/.github/git/refs   -f ref=refs/tags/v2 -f sha=d3d768dabb7f28cc63283cdfe48630da53700e50

c. On a feature branch in petry-projects/.github, update:

• .github/workflows/pr-review-mention.yml (caller stub)
• standards/workflows/pr-review-mention.yml (template)

Each: change the uses: line from @v1 to @d3d768dabb7f28cc63283cdfe48630da53700e50 # main.

Open draft PR titled: fix: pin pr-review-mention reusable to d3d768d SHA.

Step 2 — Caller repos (parallel after Step 1a/1b)

For each of:

• petry-projects/google-app-scripts
• petry-projects/TalkTerm
• petry-projects/bmad-bgreat-suite

Apply this one-line diff in .github/workflows/pr-review-mention.yml:

-    uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v1
+    uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@d3d768dabb7f28cc63283cdfe48630da53700e50 # main

Open draft PRs. Commit message: fix: pin pr-review-mention reusable to SHA with body explaining the stale-v1-tag root cause.

For google-app-scripts specifically:

• Existing PR 💡 Reusable Workflow Semantic Versioning and Release Automation #272 must NOT be merged. Either:
  • (i) Push the corrected SHA onto branch claude/issue-271-20260511-1237 (the PR's head branch) so 💡 Reusable Workflow Semantic Versioning and Release Automation #272 becomes correct, OR
  • (ii) Close 💡 Reusable Workflow Semantic Versioning and Release Automation #272 and open a fresh PR.
• There is also a branch claude/fix-pr-review-workflow-AIYvK created for this fix; pick whichever branch you prefer and close the other to avoid confusion.

Step 3 — Verify each caller after merge

For each of the four caller repos:

1. As an OWNER/MEMBER, post a comment containing @donpetry-bot on any open PR.
2. Confirm a new run of "PR Review — Mention Trigger" appears in Actions and reaches the handle-mention job (no parse error).

Step 4 — Close compliance findings

• Close petry-projects/google-app-scripts#271 once the SHA-pin lands on main.
• Search and close analogous compliance-audit issues in .github, TalkTerm, and bmad-bgreat-suite if any exist:

gh search issues "in:title pr-review-mention" --owner petry-projects   --state open --json repository,number,title

Step 5 — Prevent recurrence

Add a one-line note to petry-projects/.github CONTRIBUTING (or to the file header of pr-review-mention-reusable.yml):

"When publishing a new SHA of this reusable, also update standards/workflows/pr-review-mention.yml and open a fanout PR across caller repos."

This prevents the template and the callers from drifting again.

---

Guardrails

• Do NOT skip git hooks, force-push to main, or bypass signing.
• The v1 tag move is the only destructive git op authorized; use the gh api PATCH form above, not git push --force.
• Open all PRs as drafts.
• Do not change anything else in the caller stubs — they are thin caller stubs by design and the file headers warn against modification beyond the uses: line.

---

Done When

• v1 tag in petry-projects/.github points to d3d768d
• v2 tag in petry-projects/.github exists at d3d768d
• All 5 files listed under Scope reference d3d768d via SHA pin
• A test mention of @donpetry-bot on any caller-repo PR produces a successful "PR Review — Mention Trigger" run with an ack comment
• Compliance issue 💡 Token Cost Observatory with Pre-Agentic Optimization #271 (and any analogs) closed

Report back with: links to the 4 PRs, confirmation that the v1/v2 tags moved, and the URL of one successful verification run.

[don-petry]

Claude finished @don-petry's task in 7m 10s —— View job • claude/issue-267-20260513-1233 • Create PR ➔

---

Fixing stale v1 tag — pr-review-mention reusable workflow

• Read AGENTS.md and relevant standards
• Read current state of affected files
• Move v1 tag → d3d768dabb7f28cc63283cdfe48630da53700e50 ✓ verified
• Cut v2 tag at d3d768dabb7f28cc63283cdfe48630da53700e50 ✓ verified
• Update standards/workflows/pr-review-mention.yml (SHA pin + fanout reminder)
• .github/workflows/pr-review-mention.yml — already uses local ./ ref, no change needed
• Update google-app-scripts (pushed correct SHA to existing PR 💡 Reusable Workflow Semantic Versioning and Release Automation #272 branch)
• Update TalkTerm — PR opened
• Update bmad-bgreat-suite — PR opened
• Open draft PRs for all repos
• Found compliance issues to close after merge (google-app-scripts 💡 Token Cost Observatory with Pre-Agentic Optimization #271, TalkTerm Daily org status report via GitHub Actions #169, bmad-bgreat-suite feat(dependabot-rebase): add workflow_dispatch trigger #139)

---

Tag operations (applied immediately, out-of-band)

Tag	SHA	Status
v1	d3d768d	✅ force-moved
v2	d3d768d	✅ newly cut

Draft PRs

Repo	PR
petry-projects/.github	#268 — fix: pin pr-review-mention reusable to d3d768d SHA
google-app-scripts	#272 — updated with correct SHA (was pointing at broken 0cb4bba1; branch pushed with d3d768d)
TalkTerm	#173
bmad-bgreat-suite	#147

What's left after merging

• Close compliance issues: google-app-scripts #271, TalkTerm #169, bmad-bgreat-suite #139
• Additional repos with same unpinned-actions-pr-review-mention.yml finding (outside original scope): petry-projects/broodly (Org Status — 2026-05-04 #185), petry-projects/markets (fix(compliance): disable false positive reusable-workflow-path-duplicate-github check #164) — may need separate fanout PRs

Notes

• petry-projects/.github dogfooded caller (.github/workflows/pr-review-mention.yml) already used a local ./ ref, so it was never broken and required no changes
• No CODEOWNERS file found in this repo
• Step 3 (verification via @donpetry-bot mention) and Step 4 (closing compliance issues) require the PRs to merge first
  | Branch