fix: pin pr-review-mention reusable workflow to SHA

[don-petry]

Summary

• Pin .github/workflows/pr-review-mention.yml to the correct SHA d3d768dabb7f28cc63283cdfe48630da53700e50 (latest main commit containing the reusable workflow)

Root cause: The v1 lightweight tag in petry-projects/.github pointed to commit 0cb4bba1 which predates the addition of pr-review-mention-reusable.yml, causing a parse-time error in all caller repos:

error parsing called workflow: failed to fetch workflow: workflow was not found.

The v1 tag has been force-moved to d3d768d and a new v2 tag cut at the same SHA.

Ref: petry-projects/.github#267

Closes #271

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CI/CD workflow configuration to use a pinned commit reference instead of a tag-based reference.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: db88c48a-a56e-4912-a83c-b4abeffe92ac

📥 Commits

Reviewing files that changed from the base of the PR and between e9f5bc9 and dd4a2fb.

📒 Files selected for processing (1)

• .github/workflows/pr-review-mention.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/pr-review-mention.yml

---

📝 Walkthrough

Walkthrough

The PR pins the pr-review-mention reusable workflow reference from a floating @v1 tag to a specific commit SHA (d3d768dabb7f28cc63283cdfe48630da53700e50) and adds documentation instructing that future SHA updates should trigger template and fan-out PR updates across caller repositories.

Changes

Workflow Pinning and Documentation

Layer / File(s)	Summary
Pin reusable workflow reference and document process .github/workflows/pr-review-mention.yml	Workflow documentation clarifies that template updates and fan-out PRs across caller repos are required when publishing new reusable workflow SHAs. The pr-review-mention job uses call is pinned from @v1 tag to commit d3d768dabb7f28cc63283cdfe48630da53700e50.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~5 minutes

Possibly related issues

• Compliance: unpinned-actions-pr-review-mention.yml #271: Compliance: unpinned-actions-pr-review-mention.yml — This PR directly resolves the compliance finding by pinning the reusable workflow reference to a specific commit SHA as required by the action-pinning policy.

Possibly related PRs

• petry-projects/google-app-scripts#134 — Both PRs update workflow caller jobs to invoke reusable workflows via pinned commit SHAs instead of floating tags.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: pinning a reusable workflow reference from @v1 tag to a specific commit SHA.
Linked Issues check	✅ Passed	The PR successfully addresses issue #271 by pinning the pr-review-mention reusable workflow to commit SHA d3d768dabb7f28cc63283cdfe48630da53700e50, satisfying the action-pinning compliance requirement.
Out of Scope Changes check	✅ Passed	All changes are in scope: updating the workflow reference to a pinned SHA and updating inline documentation about the pinning process. No extraneous modifications detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-271-20260511-1237

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Pins the PR review mention thin-caller workflow to a specific commit SHA to comply with the action pinning policy referenced in issue #271.

Changes:

• Update the reusable workflow reference in .github/workflows/pr-review-mention.yml from @v1 to a full commit SHA (@0cb4bba11d7563bf197ad805f12fb8639e4879e4) while retaining the # v1 annotation.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/pr-review-mention.yml (1)

9-10: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Update lines 9-10 to reflect the SHA-based pinning approach.

Lines 9-10 still reference the old tag-based approach (bumping @v1 → @v2), but the new documentation (lines 16-17) and implementation (line 39) use SHA-based pinning. This inconsistency could confuse future maintainers and lead them to revert to tags, violating the organization's action-pinning compliance policy that this PR is meant to satisfy.

📝 Suggested documentation update

-#   • You MAY change: the tag in the `uses:` line when upgrading the reusable
-#     workflow version (e.g. bump `@v1` → `@v2` when petry-projects/.github cuts a new release).
+#   • You MAY change: the SHA in the `uses:` line when upgrading the reusable
+#     workflow version (obtain the new SHA from petry-projects/.github and follow the fanout process below).

Also applies to: 16-17

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-review-mention.yml around lines 9 - 10, Update the
explanatory comments that currently mention tag-based pinning (the guidance
about bumping `@v1` → `@v2` found near the `uses:` explanation) to describe and
require SHA-based pinning instead, matching the documentation later (lines
referencing SHA-based pinning) and the actual `uses:` implementation at line 39;
specifically replace the text that tells maintainers to bump tags with
instructions to pin reusable workflows by full commit SHA and reference the
`uses:` lines as the place to apply that SHA-based pinning so the comments are
consistent with the implementation.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/pr-review-mention.yml:
- Around line 9-10: Update the explanatory comments that currently mention
tag-based pinning (the guidance about bumping `@v1` → `@v2` found near the
`uses:` explanation) to describe and require SHA-based pinning instead, matching
the documentation later (lines referencing SHA-based pinning) and the actual
`uses:` implementation at line 39; specifically replace the text that tells
maintainers to bump tags with instructions to pin reusable workflows by full
commit SHA and reference the `uses:` lines as the place to apply that SHA-based
pinning so the comments are consistent with the implementation.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6cc79943-ef6a-495b-9df0-fa29c124b738

📥 Commits

Reviewing files that changed from the base of the PR and between 37ab24c and e9f5bc9.

📒 Files selected for processing (1)

• .github/workflows/pr-review-mention.yml

[don-petry]

@donpetry-bot

[don-petry]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR