feat: implement issue #331 — Compliance: stub-surface-drift-pr-auto-review.yml-on

[don-petry]

Closes #331

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 9 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a4f826b4-6a32-46b3-9e52-d22f64734907

📥 Commits

Reviewing files that changed from the base of the PR and between 78b40c7 and f71dd9a.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-331-20260721-1931

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR resolves compliance issue #331 by re-syncing the .github/workflows/pr-auto-review.yml thin caller stub’s on.workflow_run surface to match the canonical org standard, removing repo-specific drift.

Changes:

• Update on.workflow_run.workflows to only include the repository CI workflow ("CI"), matching the standard template’s expected trigger surface.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: f71dd9a278bd1bd74bc77069bb1847631f2cb00b
Review mode: triage-approved (single reviewer)

Summary

One-line compliance fix: re-syncs the pr-auto-review.yml thin caller stub's workflow_run trigger list from ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"] back to the canonical ["CI"], as required by compliance issue #331. Verified the resulting on: block matches the canonical standards/workflows/pr-auto-review.yml verbatim (only a non-functional TODO comment differs). Triage assessment (low-risk) is confirmed.

Linked issue analysis

Issue #331 (compliance audit, severity: error) flagged drift in the stub's on: surface vs the canonical template, which owns triggers centrally. The PR restores workflow_run.workflows to ["CI"] — exactly matching the canonical template and the repo's actual CI workflow name. The finding is substantively and fully addressed.

Findings

• No security concerns: the change reduces trigger surface; no permissions, secrets, or pinning changes.
• Informational (non-blocking): removing "SonarCloud Analysis"/"CodeQL"/"Dev-Lead Agent" from workflow_run means the readiness gate no longer re-fires when those GitHub Actions workflows complete (check_suite does not fire for Actions runs). The canonical design covers re-evaluation via check_suite (third-party apps), pull_request_review, and pull_request events, and this surface is centrally owned — any behavioral concern belongs in the central repo, not this stub.
• Secret scan: run_secret_scanning MCP tool not available in this environment; gitleaks CI check passed (SUCCESS).

CI status

All checks green: CI (Detect ecosystems, Secret scan/gitleaks) SUCCESS; CodeQL SUCCESS; SonarCloud Quality Gate passed (0 new issues, 0 hotspots); AgentShield SUCCESS; dependency-audit SUCCESS; remaining checks SKIPPED (not applicable). No failures.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.