fix: pin pr-review-mention reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml from the mutable @v1 tag to its commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4
• SHA was resolved via gh api repos/petry-projects/.github/git/refs/tags/v1 — no fabrication
• Retains the # v1 comment so the human-readable version is still visible

Compliance

Addresses the action-pinning compliance finding in the org CI standards.

Closes #164

---

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated continuous integration workflow configuration to use a pinned reference, enhancing stability and reliability of the automated development processes.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c2df2be7-0444-4144-aece-c13c442070a1

📥 Commits

Reviewing files that changed from the base of the PR and between 2487ce6 and 9515f16.

📒 Files selected for processing (1)

• .github/workflows/pr-review-mention.yml

---

📝 Walkthrough

Walkthrough

The PR updates the pr-review-mention workflow's reusable workflow reference from the @v1 tag to a pinned commit SHA to comply with action-pinning standards.

Changes

Workflow pinning compliance

Layer / File(s)	Summary
Pin pr-review-mention workflow reference to commit SHA .github/workflows/pr-review-mention.yml	The uses: directive for the reusable workflow reference is updated from @v1 tag to a specific pinned commit SHA.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: pin pr-review-mention reusable workflow to SHA' accurately and concisely describes the main change: pinning the reusable workflow reference from a mutable tag to a specific commit SHA.
Linked Issues check	✅ Passed	The pull request successfully addresses issue #164 by pinning the unpinned action to a commit SHA (0cb4bba11d7563bf197ad805f12fb8639e4879e4), bringing the repository into compliance with the action-pinning policy.
Out of Scope Changes check	✅ Passed	The pull request contains only the necessary change to address the linked issue: updating the workflow reference to use a pinned SHA. No extraneous or unrelated changes are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-164-20260511-1240

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review complete — no issues found.

Change: Single-line pin of the reusable workflow reference from the mutable @v1 tag to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4.

• SHA resolved via gh api repos/petry-projects/.github/git/refs/tags/v1 (type: commit, lightweight tag — no deref needed).
• # v1 comment retained for human readability.
• No other uses: references in this file; no other changes needed.
• Triggers, permissions: block, and job structure are untouched per the in-file AGENTS note.

@petry-projects/org-leads — please review and merge when CI is green.

[Copilot]

Pull request overview

Pins the pr-review-mention thin-caller workflow’s reusable workflow reference to an immutable commit SHA to satisfy the org “action-pinning” compliance requirement.

Changes:

• Replaces @v1 with commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 for the reusable workflow reference
• Preserves a human-readable # v1 comment alongside the SHA

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: d15862edb0097f5685395d3cf935b149cde41f67
Review mode: triage-approved (single reviewer)

Summary

Confirms the triage assessment. The diff is a single 23-line addition to .github/workflows/ci.yml introducing a new secret-scan job that runs gitleaks/gitleaks-action@v2.3.9 (SHA-pinned) against the full git history (fetch-depth: 0) via actions/checkout@v6.0.2 (SHA-pinned). No existing job or logic is modified.

Linked issue analysis

Closes #141 (Compliance: secret_scan_ci_job_present, severity error, category push-protection), auto-filed by the weekly compliance audit. The issue body asks specifically for the gitleaks job from standards/push-protection.md#required-ci-job to be added to ci.yml. The PR is the minimal, on-point fix for that finding.

Findings

• Action pinning correct. Both actions/checkout@de0fac2e… and gitleaks/gitleaks-action@ff98106e… are pinned to full 40-char SHAs with human-readable tag comments (# v6.0.2, # v2.3.9), in line with the Action Pinning Policy referenced inline. Refresh procedure is documented in comments next to each pin.
• Permissions scoped minimally. The new job declares contents: read and security-events: write only — the latter is the standard surface for actions that may upload SARIF, and the former is read-only. No pull-requests: write or id-token: write is granted.
• Secrets handling is sane. GITHUB_TOKEN is passed via the standard expression; GITLEAKS_LICENSE was added in the follow-up commit (d15862e) because gitleaks-action v2 requires it for org repos — without it the action exits non-zero on organization-owned runners. Both flow through env, not with:, matching the action's documented contract.
• PR description minor drift (non-blocking). The PR body still says the job uses --redact to prevent leaked values from appearing in logs. The follow-up commit removed the with: args: block because gitleaks-action@v2's action.yml defines no inputs and silently ignored them. Redaction is effectively still in place because gitleaks-action v2 redacts findings in its default output, but the description text is now slightly out of date. Worth a future cleanup; not a correctness issue.
• No security regression. This is a net-positive change — it adds a CI-gated secret scan where none existed. Workflow-level permissions: block is present at the job scope, and no new third-party action is introduced unpinned.
• Informational: prior bot review noise. Two earlier automated reviews on this same head SHA describe entirely different PRs (one about scripts/compliance-audit.sh/issue #239, another about .github/workflows/pr-review-mention.yml/issue #139). This appears to be a review-bot artifact, not a content match against this PR; flagging only so a human knows the duplicate entries are not relevant to PR #143.

CI status

All required checks green on d15862e: CI / Validate, CI / Secret scan (gitleaks) (the new job itself runs clean and completes in ~6s), AgentShield, CodeQL (Analyze (actions)), SonarCloud (Quality Gate passed, 0 new issues / 0 hotspots / 0.0% duplication), Claude Code, CodeRabbit (CodeRabbit content review was rate-limited but its status check is SUCCESS), Dependency audit (ecosystem detector). Skipped jobs (dependabot-automerge, language-specific audits, claude-ci-fix, claude-issue) are conditional and not applicable. mergeStateStatus is BLOCKED only on the missing approving review — no failing check.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: adaca81665cd6da85c0837b8c8c40ff762d7ae50
Review mode: triage-approved (single reviewer)

Summary

This PR modifies a single file — agents/pr-reviewer.md — to expand the PR-review agent profile with the 7 safety checks specified in #43. No executable code, workflows, dependencies, secrets, or schemas are touched. The change is a prose/policy update to a Markdown agent prompt, and all CI checks are green. Triage classification (LOW risk, single-file documentation) confirmed.

Linked issue analysis

#43 — "PR Review Agent Improvements." Verified that each acceptance criterion is substantively addressed in the diff:

AC	Addressed	Where
AC-1 CI Weakening Detection (hard stop, with file/line)	✓	Tier 1 §3b + Key rules + Decision framework
AC-2 Code Duplication Check (MEDIUM, with existing path)	✓	Tier 2 §3b
AC-3 Critical Path Tracing (MEDIUM/HIGH, perms on all branches, boundary gaps)	✓	Tier 2 §3c
AC-4 Large PR Gating (≥5 unrelated files, unsummarizable, test-only with red CI)	✓	Tier 1 §3c
AC-5 Prompt Injection in Workflows (HIGH, with file/step/line)	✓	Tier 2 §3a
AC-6 PR Description Scoring (5-element table, 3+ missing = MEDIUM)	✓	Tier 1 §3d + Output format
AC-7 Structured Tiered Protocol (Tier 1 no tools, Tier 2 fixed order, Tier 3 triggers, idempotency pre-tools)	✓	Protocol Steps 2–5

The second commit (adaca81) explicitly addressed gemini-code-assist's note about idempotency-check ordering by moving it to Step 2 (after the single mandatory metadata fetch and before any further tool calls), with a Why here note that documents the trade-off. This is the only sensible interpretation of AC-7's "before any tool calls" given that the marker lives in reviews/comments.

PR Description Quality

Element	Present
Problem statement	✓
Risk category	✗ (implied LOW but not stated)
Test plan	✓
Rollback procedure	✓
Monitoring/observability plan	✓

4 of 5 elements present — no MEDIUM finding triggered.

Findings

LOW — agents/pr-reviewer.md (Tier 2 section, Step 4 sub-headings)

• Description: Tier 2 sub-sections are numbered #### 3a. CI/workflow changes, #### 3b. Code duplication search, #### 3c. Critical path trace, #### 3d. Security boundaries, but they live under ### Step 4 — Tier 2. The 3a–3d prefix duplicates the 3a–3f numbering used in Step 3 (Tier 1 Triage) just above. Functionally harmless but mildly confusing on a quick read.
• Recommendation: Renumber as 4a–4d in a follow-up if convenient. Not a blocker.

Advisory notes carried forward from gemini-code-assist (non-blocking — author may address in a follow-up):

• Consider extending the CI-weakening pattern list to include fdescribe/fit/.only (focused tests that silently exclude siblings).
• Consider including commit messages alongside diff text when scanning for prompt-injection signals.
• Severity labels are consistent across the document; no action needed.

No HIGH or MEDIUM findings.

CI status

All required checks green: AgentShield ✓, Claude Code ✓, CodeQL ✓ (Actions + summary), Dependency audit ✓, SonarCloud ✓ (Quality Gate passed, 0 new issues), CodeRabbit ✓. SKIPPED checks (dependabot-automerge, claude-ci-fix, claude-issue, language-specific audit shards) are correctly skipped for a docs-only change with no matching ecosystem manifests.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.

Superseded by automated re-review at 64a146a.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push