feat: implement issue #372 — Compliance: stub-surface-drift-pr-auto-review.yml-permissions

[don-petry]

Closes #372

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Simplified automated pull request review workflow permissions without changing its behavior or configuration.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 640f9b93-263e-44a5-a06e-bad18d501470

📥 Commits

Reviewing files that changed from the base of the PR and between df95d26 and f3ca683.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

💤 Files with no reviewable changes (1)

• .github/workflows/pr-auto-review.yml

---

📝 Walkthrough

Walkthrough

The pull request removes statuses: read from the PR auto-review caller workflow’s job-level permissions. The reusable workflow reference, secret, and remaining permissions are unchanged.

Changes

PR auto-review workflow

Layer / File(s)	Summary
Align caller permissions .github/workflows/pr-auto-review.yml	Removes the statuses: read permission while preserving the reusable workflow invocation and other permission entries.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• petry-projects/ContentTwin#347 — Addresses the same centralized permissions-drift concern for the PR auto-review caller.
• petry-projects/google-app-scripts#451 — Concerns removal of the same statuses: read permission from the PR auto-review caller.
• petry-projects/markets#331 — Concerns centrally managed permissions in the same caller workflow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is specific and matches the workflow permissions-drift fix in pr-auto-review.yml.
Linked Issues check	✅ Passed	The change removes the drifted statuses permission from the caller stub, matching the requested permissions resync.
Out of Scope Changes check	✅ Passed	Only the requested permissions surface change is present; no unrelated workflow fields were modified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-372-20260717-1401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[Copilot]

Pull request overview

This PR addresses compliance issue #372 by changing the permission surface of the .github/workflows/pr-auto-review.yml thin caller workflow.

Changes:

• Removed statuses: read from the job-level permissions: block in pr-auto-review.yml.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 4ea05896bb8681af54f66ae26c4a93b4e3c9dff2
Review mode: triage-approved (single reviewer)

Summary

One-line privilege-reducing change: removes 'statuses: read' from the job-level permissions block of the pr-auto-review.yml thin caller stub, re-syncing it verbatim with the canonical standards/workflows/pr-auto-review.yml template as required by compliance issue #372.

Linked issue analysis

Closes #372 (compliance audit finding: stub-surface-drift-pr-auto-review.yml-permissions). The finding requires the stub's permissions: block to be re-synced from the canonical standards/workflows/pr-auto-review.yml. Verified against the canonical template: its job-level block is exactly pull-requests: read, checks: read, actions: read — the post-change stub now matches verbatim. The @pr-auto-review/v1-ring1 channel pin is untouched, and the finding explicitly permits per-repo tier channel pins. The issue is substantively and completely addressed.

Findings

• Stale comment on deleted line is not a regression risk. The removed line claimed statuses: read was "required by pr-auto-review-reusable.yml since #435", so I verified the reusable directly: every API step authenticates with the GH_PAT_WORKFLOWS secret (a PAT), not the default GITHUB_TOKEN, so caller-granted token permissions beyond the canonical three are unused. The reusable's own job also declares only pull-requests/checks/actions: read. The claim is stale; the canonical template (source of truth) omits statuses: read.
• Functionally proven on this PR: the modified stub ran on this PR's merge ref and pr-auto-review / check-and-dispatch completed SUCCESS.
• Privilege-reducing: the change narrows the token grant; no new capabilities, triggers, refs, or secrets are introduced.
• Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check passed, and the diff (single deleted line) contains no secret material.
• Minor pre-existing nit (not introduced by this PR, non-blocking): the file lacks a trailing newline.

CI status

All checks green: gitleaks secret scan, CodeQL (actions + python), SonarCloud quality gate (0 new issues, 0 hotspots), AgentShield, and pr-auto-review ready-check all SUCCESS; remaining contexts intentionally SKIPPED (dependabot/ecosystem audits not applicable). Mergeable; merge state BLOCKED only on the pending review this verdict satisfies.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud