fix(settings): disable check-suite auto-trigger for .github repo

[don-petry]

Summary

• Applied PATCH repos/petry-projects/.github/check-suites/preferences to set auto_trigger_checks: false for Claude (app_id: 1236702) and CodeRabbit (app_id: 347564)
• Updates compliance status table in standards/github-settings.md to reflect the 2026-05-08 remediation

Root Cause

GitHub was auto-creating a "queued" check suite for Claude on every push. The suite stays in queued state permanently when Claude has no work to do, blocking GitHub auto-merge (which waits for all suites to reach a terminal state before merging).

Fix Applied

The settings change was applied directly via API before this PR was created. The PR documents the remediation date in the compliance status table. The next compliance audit run will confirm the finding is resolved.

Closes #210

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 1 minute and 37 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9e22e162-73a6-4659-8442-1c58c9864b93

📥 Commits

Reviewing files that changed from the base of the PR and between a4fd43e and df821ea.

📒 Files selected for processing (1)

• standards/github-settings.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-210-20260508-1408

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@petry-projects/org-leads — the check-suite auto-trigger settings fix has been applied and this PR documents the remediation. Please review and merge when CI passes.

[Copilot]

Pull request overview

Documents the remediation of a GitHub repository setting in petry-projects/.github to prevent auto-created check suites from remaining permanently queued and blocking GitHub auto-merge.

Changes:

• Updates the “Current Compliance Status” section date to 2026-05-08.
• Adds clarification that .github check-suite auto-trigger preferences were re-applied via API, while the last full org-wide remediation remains 2026-04-05.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

@claude this branch is behind main and we'd like to validate the new agentic-rebase flow proposed in #231 before merging that PR.

Please:

1. Check out this branch (claude/issue-210-20260508-1408).
2. Rebase it onto origin/main, resolving any conflicts that arise.
3. Force-push the result with --force-with-lease.
4. Leave a brief comment summarizing what you did (or what blocked you).

git fetch origin
git rebase origin/main
git push --force-with-lease

This is a manual dry-run of the workflow change in #231 — we want to confirm the @claude mention reliably triggers a successful rebase before we wire the fallback into auto-rebase-reusable.yml and the daily-org-status workflow.

---

Generated by Claude Code

[claude]

Claude finished @don-petry's task in 24s —— View job

---

Rebase Request — Blocked

Unfortunately, I'm unable to perform this rebase. Rebasing is outside my capabilities — I can only create and push commits; I cannot perform branch operations like rebase, merge, or other git history rewrites.

From my capabilities:

"Perform branch operations (cannot merge branches, rebase, or perform other git operations beyond creating and pushing commits)"

You can find more information and potential workarounds in the FAQ.

What you can do instead

Run the rebase manually to complete the dry-run validation:

git fetch origin
git checkout claude/issue-210-20260508-1408
git rebase origin/main
git push --force-with-lease

Or, if the goal of #231 is to automate this via a GitHub Actions workflow, the rebase steps would need to run as a native workflow step (not via a @claude comment) since the git rebase operation requires direct shell execution with appropriate token permissions.

---

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: a191bfcfa6fc014ce4d88ea3ba70860a890233d4
Review mode: triage-approved (single reviewer)

Summary

Single-line CI workflow change pinning petry-projects/.github/.github/workflows/agent-shield-reusable.yml from the mutable @v1 tag to the exact commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4, with the # v1 human-readable comment retained and the with: required-files: AGENTS.md input preserved. Verified via gh api repos/petry-projects/.github/git/refs/tags/v1 that the pinned SHA matches the actual commit currently behind the v1 tag. Conforms to the org action-pinning policy and follows the same pattern as the recently merged #127 (auto-rebase-reusable.yml SHA pin).

Linked issue analysis

Closes #114 — a compliance-audit finding for unpinned-actions-agent-shield.yml flagging that agent-shield.yml had 1 action not pinned to SHA. The PR addresses exactly that line; no other unpinned references remain in this workflow.

Findings

No issues found.

• SHA pin verified against upstream tag v1 (matches 0cb4bba11d7563bf197ad805f12fb8639e4879e4).
• Repo-specific with: inputs preserved unchanged.
• No secrets, permissions, or trigger surface modified.
• Pre-existing missing trailing newline on the file is unchanged by this PR; out of scope.

CI status

All required checks green: AgentShield, Claude Code, CodeQL (Analyze actions), Dependency audit (ecosystem detect), SonarCloud / SonarCloud Code Analysis (Quality Gate passed, 0 new issues), CodeRabbit. Dependabot auto-merge and ecosystem-specific audit jobs correctly skipped (no matching ecosystems / not a Dependabot PR). CodeRabbit posted a rate-limit notice but its status check reports SUCCESS; gemini-code-assist skipped due to unsupported file type. Mergeable: yes; merge state BLOCKED only on the required human review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud