feat: implement issue #249 — Compliance: non-stub-auto-rebase.yml

[don-petry]

Closes #249

Implemented by dev-lead agent. Please review.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 59 minutes and 38 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ac32e1c6-db6f-40b7-b1ac-362dc071c192

📥 Commits

Reviewing files that changed from the base of the PR and between 61aa4ee and 9e9c477.

📒 Files selected for processing (2)

• .github/workflows/auto-rebase.yml
• .gitignore

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-249-20260526-1710

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request adds a duplicate entry for .dev-lead/ to the .gitignore file. The review feedback correctly points out that this directory is already ignored multiple times in the file, making the new entry redundant.

[gemini-code-assist]

The directory .dev-lead/ is already ignored in this file multiple times. Adding another duplicate entry is redundant.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: de650de583

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin reusable workflow to immutable commit SHA

Replace the @v1 ref with a commit SHA here, because this workflow previously pinned to an exact reusable version and the file’s own contract (lines 9–10) says upgrades should bump the SHA. Using a moving tag makes behavior non-deterministic across runs and can silently change auto-rebase logic (or reintroduce old behavior versus the prior # v2 pin) without any change in this repository, which is a reliability and maintainability regression for CI.

Useful? React with 👍 / 👎.

[Copilot]

Pull request overview

Implements compliance remediation for issue #249 by updating the repo’s thin-caller auto-rebase workflow to pin the org reusable workflow to @v1 (org standard).

Changes:

• Pin .github/workflows/auto-rebase.yml reusable workflow reference to petry-projects/.github/...@v1.
• Add an additional .dev-lead/ ignore entry in .gitignore (currently creating further duplication).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/auto-rebase.yml	Updates the reusable workflow reference to @v1 for compliance.
.gitignore	Adds another .dev-lead/ ignore line (but the file already contains multiple duplicates).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

CI Failure: SonarCloud Code Analysis

Step: SonarCloud Code Analysis (Quality Gate)
Root cause: Config error

The PR changes .github/workflows/auto-rebase.yml to reference the reusable workflow via a mutable tag (@v1) instead of the previously pinned commit SHA (@376a4fcb1117444595e3e702fa450873d0e54310 # v2). SonarCloud flags this as a security vulnerability (CWE-829 / S6900-class): using a mutable tag means the referenced workflow could be silently updated to a different — potentially malicious — version, undermining supply-chain integrity.

Suggested fix: Revert the action reference back to the pinned SHA (petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@376a4fcb1117444595e3e702fa450873d0e54310) or pin @v1 to its current resolved SHA and append a # v1 comment for readability.

View run logs

[don-petry]

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5ccb1d7a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep auto-rebase on the v2 reusable workflow

This is separate from the earlier pinning comment: the fresh evidence is that the ref is now SHA-pinned but its inline label is still # v1, while the parent commit called the # v2 SHA. On every push to main or manual dispatch, this caller now runs the older reusable workflow, undoing the repo's prior Dependabot major bump of auto-rebase from v1 to v2 and leaving any v2 fixes/behavior inactive for this workflow.

Useful? React with 👍 / 👎.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.