fix(compliance): disable false positive reusable-workflow-path-duplicate-github check

[don-petry]

Summary

Disables a false-positive compliance audit check that incorrectly flags the correct GitHub reusable workflow reference pattern.

Issue: The compliance audit was flagging petry-projects/.github/.github/workflows/... as incorrect
Root cause: The check didn't account for GitHub's reusable workflow syntax where the first segment is the repo name and the second is the path within that repo
Solution: Disable the check and document why the double .github/ pattern is correct per org standards

Affected Repositories

This fix prevents false-positive compliance issues across 6 repos:

• petry-projects/TalkTerm (issues fix(compliance-audit): use null-safe jq for boolean settings checks #131, chore(deps): Bump actions/setup-python from 5.6.0 to 6.2.0 #130, chore(deps): Bump actions/download-artifact from 4.3.0 to 8.0.1 #129)
• petry-projects/broodly (issues docs: document OIDC immutability constraint and exempt claude.yml from SHA pinning #159, feat: add auto-rebase workflow for non-Dependabot PRs #158)
• petry-projects/google-app-scripts (issues chore(deps): Bump anthropics/claude-code-action from 1.0.115 to 1.0.119 #226, Org Status — 2026-05-09 #225)
• petry-projects/ContentTwin (issues Compliance: missing-code-quality #111, Compliance: missing-pr-quality #110)
• petry-projects/markets (issues feat(dependabot): auto-merge major GitHub Actions updates #137, fix(ci): move Dependabot exclusion to job-level if in claude-code-reusable.yml #136)
• petry-projects/bmad-bgreat-suite (issues Auto-respond to all PR review comments without @claude mention #123, Compliance audit — 2026-04-09 #122)

Changes

• Disabled check_reusable_workflow_paths() in scripts/compliance-audit.sh
• Added documentation explaining the correct pattern per GitHub's reusable workflow syntax
• Reduces compliance audit noise going forward

Reference

GitHub Reusable Workflows: https://docs.github.com/en/actions/using-workflows/reusing-workflows

Correct pattern: uses: petry-projects/.github/.github/workflows/workflow-name.yml@v1

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 41 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 40ab93d5-cca1-4f9a-bb87-39ffb5b93f4a

📥 Commits

Reviewing files that changed from the base of the PR and between 5b345af and c17dcfb.

📒 Files selected for processing (1)

• scripts/compliance-audit.sh

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/compliance-audit-false-positive

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Disables a compliance-audit check that incorrectly flagged the org-standard GitHub reusable workflow reference pattern petry-projects/.github/.github/workflows/... as invalid.

Changes:

• Removes the prior “duplicate .github/” detection logic from check_reusable_workflow_paths().
• Adds inline documentation explaining why the double .github/ pattern is correct for the .github repo per GitHub reusable workflow syntax.
• Replaces the check implementation with a no-op return 0.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

check_reusable_workflow_paths now declares local repo="$1" but never uses it (the function immediately returns). ShellCheck will flag this as an unused variable (SC2034), which can fail CI. Remove the local assignment, or reference the value (e.g., via a no-op like : "$1") while keeping the signature.

Suggested change

	local repo="$1"
	: "$1"