fix: pin dependabot-rebase reusable workflow to SHA (issue #157)

[don-petry]

Summary

• Pins the dependabot-rebase-reusable.yml reference from @v1 tag to SHA 3c6335c6ee3e2f1a37f3e27e065e28d36d9c0dde (v1) to satisfy the action-pinning compliance policy
• Copied the workflow file verbatim from petry-projects/.github/standards/workflows/dependabot-rebase.yml — the template itself is already SHA-pinned
• Also syncs related template improvements: adds workflow_dispatch trigger, elevates permissions to contents:write/pull-requests:write, and replaces secrets: inherit with explicit secrets block

Change

-    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@v1
-    secrets: inherit
+    uses: petry-projects/.github/.github/workflows/dependabot-rebase-reusable.yml@3c6335c6ee3e2f1a37f3e27e065e28d36d9c0dde # v1
+    secrets:
+      APP_ID: ${{ secrets.APP_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

Closes #157

Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 46 minutes and 5 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 46 minutes and 5 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e9ab04a7-8368-4dc6-98ea-f513a7aa0599

📥 Commits

Reviewing files that changed from the base of the PR and between 32e618b and b1e8160.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-157-20260418-1854

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

@don-petry — this PR pins the dependabot-rebase reusable workflow to its SHA as required by the action-pinning compliance policy (issue #157). The template from petry-projects/.github/standards/workflows/dependabot-rebase.yml was copied verbatim. Please review and merge when ready.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Pins the Dependabot rebase reusable workflow to an immutable commit SHA to satisfy action-pinning compliance, and syncs the caller stub with the latest template behavior.

Changes:

• Pin reusable workflow reference from @v1 to a specific SHA.
• Add workflow_dispatch to allow manual runs.
• Replace secrets: inherit with explicit secret mappings and elevate job permissions to contents:write / pull-requests:write.

[Copilot]

The instruction to ‘bump SHA to latest main’ is easy to misread as endorsing tracking main (or an arbitrary commit) rather than a vetted release commit. To keep upgrades auditable/compliance-friendly, consider rewording this to explicitly say to bump to the SHA that corresponds to the intended released version (e.g., the commit for the v1 tag/release), and optionally include a link to the upstream release/changelog for verification.

Suggested change

	# workflow version (bump SHA to latest main of petry-projects/.github).
	# workflow version (bump to the SHA for the intended released version of
	# petry-projects/.github, such as the commit for the `v1` tag/release).