Skip to content

feat: implement issue #216 — Compliance: non-stub-dev-lead.yml#229

Open
don-petry wants to merge 1 commit into
mainfrom
dev-lead/issue-216-20260526-1711
Open

feat: implement issue #216 — Compliance: non-stub-dev-lead.yml#229
don-petry wants to merge 1 commit into
mainfrom
dev-lead/issue-216-20260526-1711

Conversation

@don-petry
Copy link
Copy Markdown
Contributor

Closes #216

Implemented by dev-lead agent. Please review.

Copilot AI review requested due to automatic review settings May 26, 2026 17:15
@don-petry don-petry requested a review from a team as a code owner May 26, 2026 17:15
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 26, 2026

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 48 minutes and 22 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6d62f13b-0d1a-494b-be98-d04295fd7511

📥 Commits

Reviewing files that changed from the base of the PR and between 5204344 and 257b4ee.

📒 Files selected for processing (2)
  • .github/workflows/dev-lead.yml
  • .gitignore
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev-lead/issue-216-20260526-1711

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds a duplicate .dev-lead/ entry to the .gitignore file. The review feedback correctly points out that this directory is already ignored multiple times in the file, making the new entry redundant and unnecessary.

Comment thread .gitignore
.dev-lead/
.dev-lead/
.dev-lead/
.dev-lead/
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

low

The directory .dev-lead/ is already ignored in this file (multiple times on lines 32-38). Adding another duplicate entry is redundant and unnecessary.

@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the repository’s Dev-Lead GitHub Actions workflow to comply with org standards by delegating to the centralized reusable workflow, aligning with issue #216’s “thin caller stub” requirement.

Changes:

  • Point dev-lead.yml to petry-projects/.github/.github/workflows/dev-lead-reusable.yml@v1 (instead of the private repo reference).
  • Add an additional .dev-lead/ ignore entry to .gitignore (currently results in heavy duplication).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
.gitignore Adds another .dev-lead/ entry (but increases existing duplication).
.github/workflows/dev-lead.yml Updates the reusable workflow reference to the standardized org-level workflow tag @v1.

@donpetry-bot
Copy link
Copy Markdown
Contributor

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 257b4ee2d020999b65ad5163b41e2c2ee29cfd73
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

The PR changes dev-lead.yml to reference petry-projects/.github/.github/workflows/dev-lead-reusable.yml@v1, but that file does not exist in the public .github repo — neither at the v1 tag (commit d3d768da) nor at main. Merging will cause the dev-lead agent workflow to fail on every trigger, silently breaking AI-assisted development. The compliance finding (#216) stems from an audit expectation that the reusable has already been published to the public .github repo, but it has not; the org's own canonical stub (standards/workflows/dev-lead.yml) still references .github-private, confirming the migration is incomplete at the org level.

Findings

  • CRITICAL (correctness): Referenced reusable workflow does not exist: petry-projects/.github/.github/workflows/dev-lead-reusable.yml is absent from the public .github repo at both the v1 tag (commit d3d768dabb7f28cc63283cdfe48630da53700e50) and at main. Merging this PR will cause the 'dev-lead' job to fail with a workflow-not-found error on every trigger event. [.github/workflows/dev-lead.yml:62]
  • MAJOR (correctness): Compliance issue Compliance: non-stub-dev-lead.yml #216 is not actually resolved by this PR. The compliance audit script checks that the uses: line matches petry-projects/.github/.github/workflows/dev-lead-reusable.yml@v1, but the reusable is still hosted exclusively in petry-projects/.github-private. The weekly audit (2026-05-29 and 2026-05-30 comments on issue Compliance: non-stub-dev-lead.yml #216) continues to flag this as open, confirming the prerequisite migration at the org level is incomplete. [.github/workflows/dev-lead.yml:62]
  • MAJOR (correctness): Org-level canonical stub (petry-projects/.github/standards/workflows/dev-lead.yml) still references .github-private/.github/workflows/dev-lead-reusable.yml@main, not the .github path the compliance audit now requires. The two sources of truth are contradictory, indicating the org migration from private to public reusable is not complete.
  • MINOR (maintainability): .gitignore gains a 4th duplicate .dev-lead/ entry (lines already repeated 3 times before this change). This is harmless but clutters the file. [.gitignore:39]
  • INFO (security): secrets: inherit is unchanged from before this PR; the security posture is not worsened. If dev-lead-reusable.yml were published to the public .github repo at a pinned tag (v1), that would actually be an improvement over the current floating @main reference in .github-private. [.github/workflows/dev-lead.yml:63]

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

Additional tasks

  1. Resolve all unresolved review thread comments from other reviewers
  2. Ensure all CI checks pass after your changes
  3. Rebase on the target branch if behind
  4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

@don-petry
Copy link
Copy Markdown
Contributor Author

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Compliance: non-stub-dev-lead.yml

3 participants