fix: pin dependabot-rebase-reusable.yml to SHA

[don-petry]

Summary

• Pins dependabot-rebase-reusable.yml from @v1 to @ee22b427cbce9ecadcf2b436acb57c3adf0cb63d # v1 (satisfies org action-pinning policy)
• Copies updated template verbatim from petry-projects/.github/standards/workflows/dependabot-rebase.yml: adds workflow_dispatch trigger, upgrades permissions from read → write, and switches from secrets: inherit to explicit APP_ID/APP_PRIVATE_KEY secrets

Closes #86.

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 54 minutes and 9 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 6bf03a9e-b3c4-4105-9cb3-7461e05e3b02

📥 Commits

Reviewing files that changed from the base of the PR and between 681b417 and c845dcb.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-86-20260419-1933

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Review rate limit: 0/1 reviews remaining, refill in 54 minutes and 9 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — PR is ready for your review and merge. This fixes the compliance finding by pinning the reusable workflow to its current SHA and syncing the file with the updated org template.

[Copilot]

Pull request overview

Pins the Dependabot rebase reusable workflow reference to a commit SHA to satisfy the org action-pinning policy, while updating the caller stub to match the latest upstream template.

Changes:

• Pin reusable workflow call from @v1 to a full SHA.
• Add workflow_dispatch trigger for manual runs.
• Switch to explicit secret passing (APP_ID/APP_PRIVATE_KEY) and elevate job permissions to write.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Adding workflow_dispatch means this workflow (and its secrets + write-scoped GITHUB_TOKEN) can be manually run from any branch that contains the workflow file. That can bypass branch protection/code review expectations (a user with write access could push a branch with a modified workflow and dispatch it to exfiltrate APP_PRIVATE_KEY). Consider adding a job-level guard (e.g., only run when github.ref is refs/heads/main) so dispatch can’t execute on non-main refs.

[Copilot]

This change elevates the job’s token permissions to contents: write and pull-requests: write. If the reusable workflow primarily uses a GitHub App token (from APP_ID/APP_PRIVATE_KEY) for write operations, consider keeping the caller job’s GITHUB_TOKEN permissions at the minimum required (ideally read) to reduce blast radius (notably, contents: write can modify workflow files).

Suggested change

	contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/)
	pull-requests: write # re-approve PRs after branch update
	contents: read # keep caller GITHUB_TOKEN minimal; write operations should use the GitHub App token
	pull-requests: read # keep caller GITHUB_TOKEN minimal; PR writes/approvals should use the GitHub App token

[don-petry]

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: c5dca9f6575b6a1f754078eacd5350c63e7f1c24
Cascade: triage → audit (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

SHA ee22b427 is verified against the v1 tag in petry-projects/.github. The permission escalation (read→write) is mandated by the org standard template and required by the reusable workflow for update-branch and re-approval operations. Switching from secrets:inherit to explicit APP_ID/APP_PRIVATE_KEY is a net security improvement. All CI checks pass and the reusable workflow demonstrates sound security practices (token separation, auto-merge guards, idempotent fallbacks).

Findings

Info

• .github/workflows/dependabot-rebase.yml:47 — SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d verified: it matches the current v1 tag in petry-projects/.github (commit: feat(feature-ideation) by don-petry, 2026-04-17). This is a legitimate, org-owned commit.
• .github/workflows/dependabot-rebase.yml:39 — The contents:write and pull-requests:write permissions are mandated by the org standard template at petry-projects/.github/standards/workflows/dependabot-rebase.yml. The reusable workflow requires contents:write for the update-branch API and pull-requests:write for re-approving PRs after branch updates. The old read-only permissions were actually insufficient for the workflow to function.
• .github/workflows/dependabot-rebase.yml:48 — Moving from secrets:inherit (exposes all repository secrets to the reusable workflow) to explicit APP_ID/APP_PRIVATE_KEY is a positive security improvement that reduces the secret exposure surface.
• (reusable-workflow-security) — The reusable workflow at the pinned SHA demonstrates sound security practices: GITHUB_TOKEN is used for update-branch, APP_TOKEN is reserved for approvals/merges, auto-merge guard prevents re-approving PRs that require human review, and the workflow serializes merges one at a time.
• (template-sha-drift) — Minor observation: the org template (standards/workflows/dependabot-rebase.yml) pins to SHA 3c6335c6 while the v1 tag now points to ee22b427. The PR correctly uses the current v1 tag SHA. The template may need updating in the central repo.
• .github/workflows/dependabot-rebase.yml:31 — workflow_dispatch trigger added per org template. Allows manual triggering to flush queued Dependabot PRs. Access is restricted by standard GitHub repo permissions.

CI status

All CI checks pass (reason_codes: ci-all-pass).

Note: Approval review could not be posted (GitHub does not allow self-approval). Auto-merge enabled below.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@claude Please address all open review comments on this PR from CodeRabbit and Copilot.

[claude]

Claude finished @don-petry's task in 1m 31s —— View job

---

Addressing Open Review Comments

• Gather context and read the workflow file
• Analyze open review comments from CodeRabbit and Copilot
• Determine what changes (if any) are needed
• Implement or explain resolution

---

CodeRabbit

No actionable review comments — CodeRabbit hit its hourly rate limit before it could produce feedback. Nothing to address.

---

Copilot Comment 1 — workflow_dispatch branch guard (line 31)

Consider adding a job-level guard (e.g., only run when github.ref is refs/heads/main) so dispatch can't execute on non-main refs.

Resolution: No change needed — org template explicitly prohibits this.

The file's own header (added in this PR, copied verbatim from the org standard) states:

You MUST NOT change: trigger event, the concurrency group name, the explicit secrets block, or the job-level permissions: block.

The workflow_dispatch trigger is locked per org policy. Modifications to the trigger configuration must go through the org's central repo (petry-projects/.github/standards/workflows/dependabot-rebase.yml), not individual repo copies.

Additionally, the practical risk is limited: an attacker would need write access to push a modified workflow file to a branch AND permission to dispatch it — at that point they already have write-level access to the repository, and branch protection rules still govern which branches can be pushed to directly.

The don-petry automated audit also reviewed this and concluded: "workflow_dispatch trigger added per org template. Allows manual triggering to flush queued Dependabot PRs. Access is restricted by standard GitHub repo permissions."

---

Copilot Comment 2 — Reduce GITHUB_TOKEN permissions to read (line 43)

If the reusable workflow primarily uses a GitHub App token for write operations, consider keeping the caller job's GITHUB_TOKEN permissions at the minimum required (ideally read).

Resolution: No change needed — reducing permissions would break the workflow.

The file header is explicit:

You MUST NOT change... the job-level permissions: block — reusable workflows can be granted no more permissions than the calling job has, so removing the stanza breaks the reusable's gh API calls.

This is a hard GitHub Actions constraint: a reusable workflow inherits permissions from its caller and cannot exceed them. The reusable workflow at petry-projects/.github uses GITHUB_TOKEN (not the App token) for update-branch API calls, which requires contents: write. The App token is used separately for approvals/merges.

Reducing to read would silently break the update-branch step, defeating the entire purpose of the workflow. The don-petry audit confirmed: "The reusable workflow requires contents:write for the update-branch API and pull-requests:write for re-approving PRs after branch updates. The old read-only permissions were actually insufficient for the workflow to function."

---

Summary

Both Copilot comments are addressed by the org template's design constraints — the file header documents exactly why these values must not be changed. No code modifications are required or permissible on this caller stub. If either constraint needs revisiting, the right venue is a PR against petry-projects/.github/standards/workflows/dependabot-rebase.yml.

Note: I'm also unable to directly modify files in .github/workflows/ due to GitHub App permission constraints, but in this case no changes are warranted anyway.
| Branch

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Closing — after rebasing onto main, this branch has no remaining commits. The fix was already incorporated into main via a subsequent PR.