ci: update dependabot-rebase.yml to canonical stub

[don-petry]

Summary

• Replaces the non-conforming dependabot-rebase.yml with the verbatim canonical stub from petry-projects/.github/standards/workflows/dependabot-rebase.yml
• Adds missing schedule trigger (0 */4 * * *) that serves as a safety net when no pushes to main occur
• Updates comment to document the schedule trigger and corrects the APP_ID permission description to include contents:write

Closes #256

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 27 minutes and 50 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 88b39333-8ad9-44cf-948d-d1e131f92931

📥 Commits

Reviewing files that changed from the base of the PR and between 06f4918 and efd3cfe.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-256-20260508-1427

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@petry-projects/org-leads — this PR brings dependabot-rebase.yml into compliance with the org standard by copying the canonical stub verbatim from petry-projects/.github/standards/workflows/dependabot-rebase.yml. The only functional change is adding the missing schedule trigger. Please review and merge when ready.

[Copilot]

Pull request overview

Updates the repository’s Dependabot rebase workflow stub to align with org standards and ensure the rebase/merge chain continues even during periods of low activity.

Changes:

• Updates the header guidance to reflect that schedule is also a required trigger (in addition to push and workflow_dispatch).
• Adds a schedule trigger (0 */4 * * *) as a safety net when main doesn’t receive pushes.
• Clarifies the APP_ID secret comment to note required GitHub App permissions include contents:write.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 1272435b13fdb4acb2de927d76806ee7e2280ff9
Review mode: triage-approved (single reviewer)

Summary

Prompt-only changes to the org status report template that reduce output size by ~29K bytes. Three changes: (1) Open Issues grouped by repo subsection instead of flat table, dropping the repeated Repo column; (2) duplicate [#N](url) | [title](url) cells merged into single [#N — title](url) cells across Needs Human Review, Open Issues, and Open Discussions tables; (3) MAX_BYTES bumped from 60000 to 64000 (still 1536 bytes below GitHub's 65536 char limit). No data-shape changes.

Linked issue analysis

No closing issue linked, but the PR body clearly describes the problem: daily report #233 exceeded the 60000-byte truncation threshold, causing head -c to drop the start of the report (the @org-leads opener and first three sections). The changes directly address this by shrinking the rendered output.

Findings

No issues found.

• MAX_BYTES 64000: Safe — leaves 1536 bytes of headroom below GitHub's 65536-char issue body limit. Combined with the ~29K reduction in report size, truncation should rarely trigger.
• Prompt template changes: Clean restructuring. The per-repo subsection format for Open Issues and the single-link cell pattern are consistent across all three tables.
• No security concerns: No secrets, auth, eval, injection vectors, or CI security changes.
• Copilot's suppressed comment about UTF-8 truncation in head -c is a pre-existing concern in the truncation step, not introduced by this PR.

CI status

All checks passed:

• Lint: ✓
• ShellCheck: ✓
• Agent Security Scan: ✓
• AgentShield: ✓
• CodeQL (actions): ✓
• SonarCloud: ✓ (0 new issues, 0 security hotspots)
• Dependency audit: ✓

---

Reviewed automatically by the PR-review agent (single-reviewer). Reply if you need a human review.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: da50ea5ec4fb0491b665f65a70d7685e7f32bbc6
Review mode: triage-approved (single reviewer)

Summary

This PR brings .github/workflows/dependabot-rebase.yml into compliance with the org canonical stub from petry-projects/.github/standards/workflows/. The changes are minimal (+6/−3 in a single file): adds a missing schedule trigger (0 */4 * * *) as a safety net when no pushes to main occur, updates the header comment to document all three triggers, and corrects the APP_ID permission description to include contents:write.

Linked issue analysis

Closes #256 — a compliance finding (non-stub-dependabot-rebase.yml) from the weekly compliance audit requesting the workflow be replaced with the canonical stub. This PR directly addresses the finding by adopting the standard stub verbatim, including the previously missing schedule trigger.

Findings

No issues found.

• Schedule trigger 0 */4 * * *: Runs every 4 hours. This is the org-standard safety-net cadence — reasonable and not excessive.
• Comment changes only otherwise: The header guidance and APP_ID description updates are documentation-only with no functional impact.
• No permission or secrets changes: The workflow's permissions: block, concurrency: group, and explicit secrets: pass-through are unchanged.
• No security concerns: No new dependencies, no eval/injection vectors, no credential handling changes.

CI status

All checks passed:

• Build and test: ✓
• CodeQL (actions, JS/TS, Python): ✓
• SonarCloud: ✓ (0 new issues, 0 security hotspots)
• AgentShield: ✓
• Secret scan (gitleaks): ✓
• Dependency audit (npm): ✓
• Node.js tests: ✓
• Playwright UI tests: ✓
• Coverage: ✓

---

Reviewed automatically by the PR-review agent (single-reviewer). Reply if you need a human review.

Superseded by automated re-review at da50ea5.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 50158cf8ea9c8cb13d1dfa4ab3ce0f44193e398f
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)

Summary

Triage escalated due to an API artifact (gh pr diff returned 0 additions/0 deletions because of heavy merge-commit history); direct file inspection via the GitHub Contents API recovered the actual diff. The real changes are minimal: a schedule trigger (0 */4 * * *) added as a documented org-standard safety net, and two documentation-only comment corrections. The workflow remains least-privilege, the reusable is pinned to a commit SHA, there are no injection vectors, and all CI checks pass.

Findings

• INFO: gh pr diff and the PR metadata reported 0 additions/0 deletions because 30+ merge-from-main commits dominated the branch tip. The actual substantive change is commit b5523e8 (2026-05-08). Reviewers should be aware the PR API diff is unreliable for branches with many merge commits; direct Contents API calls were required to recover the diff.
• INFO: schedule trigger (0 */4 * * *) added as documented in the org canonical stub. Runs every 4 hours as a safety net when no push to main occurs. Risk is low: the workflow only calls a pinned reusable with pull-requests:write on the GITHUB_TOKEN; contents:write is supplied by a GitHub App via explicitly-passed secrets.
• INFO: top-level permissions: {} (deny-all) with pull-requests:write granted at job level only. This is correct least-privilege for a caller stub; the reusable workflow uses a GitHub App token (APP_ID/APP_PRIVATE_KEY) for contents:write operations rather than elevating GITHUB_TOKEN.
• INFO: Reusable workflow pinned to a commit SHA (b51e2edf830ea085be0277bcf3174c7b3ec8f958) rather than a mutable tag or branch ref. This is correct practice and prevents supply-chain tampering.
• INFO: The file content on main and the PR head are identical, suggesting the change may already be reflected in main (possibly through a prior untracked commit or cherry-pick). Merging would be a no-op for the file content. The PR is still worth merging to formally close issue #256 and record the compliance remediation.
• INFO: All CI checks passed: CodeQL (actions, JS/TS, Python), SonarCloud Quality Gate (0 new issues, 0 security hotspots), CodeRabbit was rate-limited and could not review. No outstanding failures.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.

Superseded by automated re-review at 50158cf.

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.