fix: pin feature-ideation.yml reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to its resolved SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 to satisfy the action-pinning compliance policy
• Syncs the file with the latest upstream template: adds the dry_run workflow_dispatch input

Closes #88

Generated with Claude Code

[don-petry]

PR is ready for review. No CODEOWNERS file found — @don-petry please review and merge when CI passes.

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 19 minutes and 14 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e13f041b-e12e-47c6-ba9b-3b3be8869aea

📥 Commits

Reviewing files that changed from the base of the PR and between 9f32983 and eb6c8d9.

📒 Files selected for processing (1)

• .github/workflows/feature-ideation.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-88-20260414-1246

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Pins the org-wide reusable “Feature Research & Ideation” workflow reference to a specific commit SHA to satisfy the action-pinning compliance policy, and syncs the caller stub with the latest upstream interface.

Changes:

• Pin petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to a resolved commit SHA.
• Add a dry_run workflow_dispatch input and forward it to the reusable workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

workflow_dispatch inputs are often surfaced as strings (e.g., 'true'/'false'). Using inputs.dry_run || false can therefore produce the string 'false' on a manual dispatch, which is truthy in GitHub expressions and can cause the reusable workflow to treat dry_run as enabled. Consider coercing to a real boolean (e.g., compare to 'true' or use fromJSON(inputs.dry_run)) before passing it to the reusable workflow.

Suggested change

	dry_run: ${{ inputs.dry_run || false }}
	dry_run: ${{ inputs.dry_run == true || inputs.dry_run == 'true' }}

[Copilot]

The header guidance says you “MUST NOT change … the uses: line”, but this PR legitimately changes it to pin to a SHA for compliance. To avoid future confusion (and reduce the risk of someone reverting the pin), update the guidance to explicitly allow/require SHA pin updates while still forbidding changing the referenced reusable workflow path.

Suggested change

	id-token: write
	id-token: write
	# Keep the reusable workflow path unchanged unless the standard itself moves.
	# Update the pinned commit SHA when adopting a newer approved standard version
	# or when compliance/security policy requires refreshing the pin.

[don-petry]

Superseded by automated re-review at 599330665c83bb8fcc735c0574d8585180c39890 — click to expand prior review.

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: 5c0454a1595d0adfb375a43960a82b278c28661c
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

This PR pins a reusable workflow reference from a mutable @v1 tag to an immutable SHA (208ec2d69b75227d375edf8745d84fbac05a76b2), which is a security improvement satisfying the org's action-pinning compliance policy (issue #88). It also adds a boolean dry_run dispatch input and forwards it to the reusable workflow — a trivial, safe change. All CI checks pass (CodeQL, SonarCloud Quality Gate, AgentShield, CodeRabbit) with zero new issues or security hotspots.

Findings

Info

• [info] .github/workflows/feature-ideation.yml:83 — Workflow reference changed from mutable @v1 tag to pinned SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 — this is the correct, secure direction per the action-pinning policy. The # v1 comment preserves human-readable intent.
• [info] .github/workflows/feature-ideation.yml:95 — dry_run input declared as boolean with default:false and forwarded via ${{ inputs.dry_run || false }}. The expression is safe — it is a typed boolean used as a reusable workflow with parameter, not interpolated into a shell command, so no injection risk exists.
• [info] CI status — All status checks green: CodeQL SUCCESS, SonarCloud SUCCESS (0 new issues, 0 security hotspots), AgentShield SUCCESS, CodeRabbit SUCCESS. Merge is blocked only on missing approving review, not on failing checks.

CI status

All checks green: CodeQL, SonarCloud Quality Gate (0 new issues, 0 security hotspots), AgentShield, CodeRabbit. Branch is BLOCKED only pending an approving review.

Note: GitHub prevents self-approval; this verdict is posted as a comment. A human reviewer must click Approve to unblock merge.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[petry-projects-pr-review-agent]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 62a21838433790642bfad56ed7b925f04a905d4e
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)

Summary

This PR pins a reusable workflow reference from the mutable @v1 tag to an immutable SHA (208ec2d69b75227d375edf8745d84fbac05a76b2), directly satisfying the org's action-pinning compliance policy (issue #88). It also adds a boolean dry_run dispatch input forwarded safely as a typed with-parameter — no injection risk. All CI checks pass (CodeQL, SonarCloud zero issues/hotspots, AgentShield, CodeRabbit); the change is strictly security-improving.

Findings

• INFO: Workflow reference changed from mutable @v1 tag to pinned SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 with a '# v1' human-readable comment. This is the correct, secure direction per the org's action-pinning policy and directly closes compliance finding #88.
• INFO: dry_run input declared as boolean type with default:false and forwarded via '${{ inputs.dry_run || false }}'. The expression is used as a typed reusable-workflow 'with' parameter, not interpolated into a shell command — no injection risk exists. The '|| false' fallback is redundant given the explicit default but harmless.
• INFO: All status checks green: CodeQL SUCCESS, SonarCloud SUCCESS (0 new issues, 0 security hotspots), AgentShield SUCCESS, CodeRabbit SUCCESS, Dependency audit SUCCESS. The retrigger commit (62a2183) at HEAD introduced no code changes — it only re-ran CI after merge-from-main syncs.
• INFO: Triage escalated with signal 'triage-output-invalid' — this is a triage infrastructure failure, not a code concern. Deep review conducted independently and finds no security or correctness issues.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - please fix this PR

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead.