fix: pin dependabot-automerge reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml from mutable @v1 tag to commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1
• Resolves the compliance finding from the weekly audit (action-pinning policy)

Changes

Updated .github/workflows/dependabot-automerge.yml:

uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@ae9709f4466dec60a5733c9e7487f69dcd004e05 # v1

The SHA was resolved from the v1 annotated tag via:

gh api repos/petry-projects/.github/git/refs/tags/v1 --jq '.object.sha'
# → tag object SHA (annotated tag)
gh api repos/petry-projects/.github/git/tags/<tag-object-sha> --jq '.object.sha'
# → ae9709f4466dec60a5733c9e7487f69dcd004e05

Test plan

• Verify CI passes
• Confirm compliance audit no longer flags this workflow

Closes #156

Generated with Claude Code

[don-petry]

PR is ready for review. @don-petry please review and merge when ready.

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 55 minutes and 30 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 55 minutes and 30 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ad8aee37-e69b-43f6-9acc-317f081cbdbb

📥 Commits

Reviewing files that changed from the base of the PR and between 56ee75a and d0b5152.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-156-20260414-1116

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Pins the Dependabot automerge reusable workflow reference to an immutable commit SHA to satisfy the org action-pinning compliance policy and close audit finding #156.

Changes:

• Updated .github/workflows/dependabot-automerge.yml to use a full 40-char commit SHA instead of the mutable @v1 tag for the reusable workflow.

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: c45f496c1e1ee85f00de018f6a981578cf4319d1
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

This PR pins a reusable workflow reference from the mutable @v1 tag to commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05, which was independently verified to be the correct commit SHA for the v1 annotated tag in petry-projects/.github. All CI checks pass (CodeQL, SonarCloud, AgentShield, Node.js, Playwright), and the change is a net security improvement — SHA pinning is the recommended GitHub Actions hardening practice.

Findings

Info

• info .github/workflows/dependabot-automerge.yml:39 — SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 independently verified against petry-projects/.github git/tags/v1 API — matches the commit the annotated tag object points to.
• info .github/workflows/dependabot-automerge.yml:40 — secrets: inherit passes all caller secrets to the reusable workflow. This is pre-existing (not introduced by this PR) and acceptable given the reusable workflow lives in the org's own trusted .github repo.
• info — The v1 annotated tag is not GPG-signed (verification.verified=false). This is common and does not undermine the SHA pinning — the SHA itself is what provides immutability.

CI status

All CI checks pass: CodeQL, SonarCloud, AgentShield, Node.js, Playwright.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[don-petry]

Closing as duplicate of #223 — same fix for issue #180. The newest attempt is kept open.