feat: implement issue #221 — Compliance: non-stub-dependabot-rebase.yml

[don-petry]

Closes #221

Implemented by dev-lead agent. Please review.

[coderabbitai]

Warning

Review limit reached

@github-actions[bot], we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 59 minutes and 22 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 48b93d2a-cc4b-4616-8cb8-79d3bfe2b54e

📥 Commits

Reviewing files that changed from the base of the PR and between ce4ddec and e877e8f.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-221-20260608-2002

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e481ebe2ad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Verify completed checks before merging

The reusable workflow pinned here now decides readiness from gh pr view --json mergeable plus “no checks pending”, but GitHub's GraphQL mergeable state is conflict-based rather than a required-check verdict, and the new reusable no longer checks completed check conclusions. In the configured flow where this app token is used as the merge/bypass actor, a Dependabot PR with a completed failing required check and no pending checks can still satisfy MERGEABLE and be squash-merged by the API path; keep the old statusCheckRollup conclusion validation or use the REST merge state that reflects branch-protection blocking.

Useful? React with 👍 / 👎.

[don-petry]

This issue lives in the reusable workflow (petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml), not in the caller stub — the caller cannot override or augment the merge-readiness logic without abandoning the thin-stub pattern. The fix (restoring statusCheckRollup conclusion validation or switching to the REST merge state) must be applied in the central reusable. This PR switches the uses: ref from the raw SHA to @v1 so the caller always tracks the canonical org-standard tag; if the reusable tag is updated with a proper check-gate fix, this repo picks it up automatically. Leaving this thread open so the upstream fix can be tracked and verified.

[Copilot]

Pull request overview

Updates the repository’s Dependabot rebase workflow stub to align with org compliance expectations for centralized workflows (issue #221), adjusting triggers and the reusable workflow reference.

Changes:

• Refreshes the header guidance/comments for the “thin caller stub”.
• Adds a scheduled trigger (every 4 hours) alongside push and workflow_dispatch.
• Updates the reusable workflow uses: reference and job permission block.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ca33d0a6b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove unsupported workflows permission

With this line present, the workflow file is invalid before the reusable job can run: I checked GitHub's jobs.<job_id>.permissions syntax, and the documented GITHUB_TOKEN permission keys include actions, contents, pull-requests, etc., but not workflows. workflows is a GitHub App/PAT repository permission, not a workflow YAML permission key, so Dependabot rebase runs will fail at workflow validation rather than gaining the intended workflow-file update capability; configure that permission on the App/token instead of in this permissions: block.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep using a reusable revision that grants contents

Switching this caller to @v1 still breaks the compare step even though line 47 grants contents: read in the caller: I checked the referenced reusable workflow at petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@v1, and its own update-and-merge job declares only permissions: pull-requests: write while running GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} gh api repos/$REPO/compare/main...$HEAD_REF. GitHub reusable workflows can only maintain or reduce the caller's token permissions, so the called job reduces contents back to none; on private/internal repos the compare API fails before Dependabot PRs can be updated or merged. This is fresh evidence beyond the earlier caller-permission comment: the newly referenced reusable revision itself removes the needed contents permission.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud quality gate
Root cause: Config error

SonarCloud flagged a security misconfiguration in .github/workflows/dependabot-rebase.yml: the uses: reference was changed from a pinned commit SHA (@0bba481...) to a mutable tag (@v1). Using a mutable tag is a supply-chain security risk because the tag can be silently redirected to a different — potentially malicious — commit without notice. SonarCloud enforces pinned SHA references for called workflows and third-party actions as a hardening requirement.

Suggested fix: Revert the uses: line to pin the reusable workflow to a specific commit SHA instead of the @v1 tag — run gh api repos/petry-projects/.github/git/refs/tags/v1 to resolve the current SHA, then replace @v1 with @<resolved-sha>.

View run logs

[don-petry]

Dev-Lead Fix CI — failed

PR: #256 | SHA: 8ca33d0a6b97bc2fcc5644a612c77b6c48c22c95
Engine invocation failed (exit 1)

[don-petry]

Closing — superseded by the #482 reusable-channel migration. These stubs are now pinned to the <name>/stable channel (templates updated in #491; the compliance audit accepts the channel as of #492), so this remediation to the old pin is no longer the right fix. The fleet re-sync to channels is opening fresh standards-sync PRs.