ci: pin feature-ideation-reusable.yml to SHA (action pinning compliance)

[don-petry]

Summary

• Pins petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to @208ec2d69b75227d375edf8745d84fbac05a76b2 (v1) per the action-pinning policy
• Syncs the missing dry_run workflow_dispatch input and corresponding with parameter from the upstream standards template

Changes

• .github/workflows/feature-ideation.yml: pin reusable workflow call to SHA, add dry_run input

Closes #159

Generated with Claude Code

[don-petry]

@don-petry — you're the code owner for this repo. PR #183 is ready for your review and merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 45 minutes and 31 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 45 minutes and 31 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 0bbce921-ef56-40e8-9ab0-299fa500de81

📥 Commits

Reviewing files that changed from the base of the PR and between 32e618b and 4fd8e6c.

📒 Files selected for processing (1)

• .github/workflows/feature-ideation.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-159-20260414-1124

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates the Feature Ideation workflow stub to comply with the org action-pinning policy and to align inputs with the upstream reusable workflow template.

Changes:

• Pin the reusable workflow reference from @v1 to a full commit SHA.
• Add a dry_run workflow_dispatch input and pass it through to the reusable workflow.

[don-petry]

Automated review — APPROVED

Risk: LOW
Reviewed commit: 50b4a6f25367e058735c1a4dc1b65072869fa42c
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Single-file CI workflow change that pins a reusable workflow reference from a mutable tag (@v1) to a pinned SHA, following the org's action-pinning policy (issue #159). A dry_run boolean input is also added to sync with the upstream reusable workflow template. All CI gates pass (CodeQL, SonarCloud 0 issues/hotspots, build, tests, AgentShield) and the change is a net security improvement.

Findings

Info

• [info] .github/workflows/feature-ideation.yml:83 — SHA pin (208ec2d69b75227d375edf8745d84fbac05a76b2 # v1) correctly follows supply-chain hardening best practice; removes mutable @v1 tag reference.
• [info] (all files) — All status checks pass: CodeQL (actions, JS/TS, Python), SonarCloud (0 new issues, 0 security hotspots), build-and-test, Node.js Tests, Playwright UI Tests, Dependency audit, AgentShield, Coverage.
• [info] .github/workflows/feature-ideation.yml:56 — dry_run input uses correct type:boolean with default:false and is passed through as inputs.dry_run || false, consistent with the upstream reusable workflow template.

CI status

All status checks pass (CodeQL, SonarCloud 0 new issues/hotspots, build-and-test, Node.js Tests, Playwright UI Tests, Dependency audit, AgentShield, Coverage).

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.