fix(ci): pin feature-ideation reusable workflow to SHA

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to commit SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 to comply with the action-pinning policy
• Adds missing dry_run workflow_dispatch input and with: parameter to align with the upstream standards template

Test plan

• Verify the workflow runs correctly with the pinned SHA on next scheduled run or manual trigger

Closes #90

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 51 minutes and 40 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 51 minutes and 40 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 27964bca-ba4d-4def-a51c-d9b8e7065724

📥 Commits

Reviewing files that changed from the base of the PR and between 051f051 and d593474.

📒 Files selected for processing (1)

• .github/workflows/feature-ideation.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-90-20260414-1324

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry PR #105 is ready for review. This fixes the compliance finding by pinning the feature-ideation-reusable.yml reusable workflow reference from @v1 to its resolved commit SHA (ae9709f4), satisfying the action-pinning policy. Also adds the missing dry_run input to align with the upstream standards template.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates the repository’s Feature Ideation workflow stub to comply with the org action-pinning standard and align with the upstream workflow interface.

Changes:

• Pin the feature-ideation-reusable.yml reusable workflow reference from @v1 to a specific commit SHA.
• Add a dry_run workflow_dispatch input and pass it through to the reusable workflow.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

workflow_dispatch inputs are provided as strings (even for type: boolean), so ${{ inputs.dry_run || false }} can evaluate to the string 'false' (truthy) and/or pass a non-boolean value into the reusable workflow. Coerce the dispatch input to a real boolean before passing it through (e.g., compare to 'true' or use fromJSON(...)) so the reusable receives an actual boolean and scheduled runs still default to false.

Suggested change

	dry_run: ${{ inputs.dry_run || false }}
	dry_run: ${{ fromJSON(inputs.dry_run || 'false') }}

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: 2b2e636cd4f3ff98d72bc3f128d5d800efd70c3f
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

This PR pins a reusable workflow reference from a floating @v1 tag to a specific commit SHA (ae9709f4), which is a security improvement that eliminates supply-chain risk from mutable tags. It also adds a missing dry_run boolean input to align with the upstream standards template. All CI checks pass (SonarCloud, CodeQL, AgentShield) with zero new issues; triage escalated only because its own output was invalid, not due to any real risk signal in the PR.

Findings

Info

• [info] .github/workflows/feature-ideation.yml:83 — SHA ae9709f4466dec60a5733c9e7487f69dcd004e05 is asserted to correspond to @v1 of petry-projects/.github feature-ideation-reusable.yml. The pinning cannot be independently verified from this reviewer, but the approach (SHA + inline comment) is correct per action-pinning policy and is a net security improvement over the mutable tag.
• [info] .github/workflows/feature-ideation.yml:95 — dry_run: ${{ inputs.dry_run || false }} correctly defaults to false for scheduled/non-dispatch triggers and passes the user-supplied boolean on manual dispatch.

CI status

All CI checks pass: SonarCloud, CodeQL, AgentShield — zero new issues.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.