fix: pin feature-ideation.yml reusable workflow to SHA by don-petry · Pull Request #102 · petry-projects/markets

don-petry · 2026-04-14T12:48:23Z

Summary

Pins petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to its resolved SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 to satisfy the action-pinning compliance policy
Syncs the file with the latest upstream template: adds the dry_run workflow_dispatch input

Closes #88

Pin `petry-projects/.github/.github/workflows/feature-ideation-reusable.yml` from `@v1` to its resolved SHA `208ec2d69b75227d375edf8745d84fbac05a76b2` to satisfy the action-pinning compliance policy. Also syncs the file with the latest upstream template: adds the `dry_run` workflow_dispatch input that was added after the initial copy. Co-authored-by: don-petry <don-petry@users.noreply.github.com>

don-petry · 2026-04-14T12:48:30Z

PR is ready for review. No CODEOWNERS file found — @don-petry please review and merge when CI passes.

sonarqubecloud · 2026-04-14T12:49:05Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai · 2026-04-14T12:50:14Z

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 43 minutes and 59 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 43 minutes and 59 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5fdf8d4b-3410-4689-b997-2e6df8cf810b

📥 Commits

Reviewing files that changed from the base of the PR and between bca8483 and 2573671.

📒 Files selected for processing (1)

.github/workflows/feature-ideation.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/issue-88-20260414-1246

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Pins the org-wide reusable “Feature Research & Ideation” workflow reference to a specific commit SHA to satisfy the action-pinning compliance policy, and syncs the caller stub with the latest upstream interface.

Changes:

Pin petry-projects/.github/.github/workflows/feature-ideation-reusable.yml from @v1 to a resolved commit SHA.
Add a dry_run workflow_dispatch input and forward it to the reusable workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-14T12:50:38Z

        include A, B, C. Key emerging trends in this space: X, Y, Z."
      focus_area: ${{ inputs.focus_area || '' }}
      research_depth: ${{ inputs.research_depth || 'standard' }}
+      dry_run: ${{ inputs.dry_run || false }}


workflow_dispatch inputs are often surfaced as strings (e.g., 'true'/'false'). Using inputs.dry_run || false can therefore produce the string 'false' on a manual dispatch, which is truthy in GitHub expressions and can cause the reusable workflow to treat dry_run as enabled. Consider coercing to a real boolean (e.g., compare to 'true' or use fromJSON(inputs.dry_run)) before passing it to the reusable workflow.

Suggested change

dry_run: ${{ inputs.dry_run || false }}

dry_run: ${{ inputs.dry_run == true || inputs.dry_run == 'true' }}

Copilot · 2026-04-14T12:50:39Z

@@ -75,7 +80,7 @@ jobs:
      pull-requests: read
      discussions: write
      id-token: write


The header guidance says you “MUST NOT change … the uses: line”, but this PR legitimately changes it to pin to a SHA for compliance. To avoid future confusion (and reduce the risk of someone reverting the pin), update the guidance to explicitly allow/require SHA pin updates while still forbidding changing the referenced reusable workflow path.

Suggested change

id-token: write

id-token: write

# Keep the reusable workflow path unchanged unless the standard itself moves.

# Update the pinned commit SHA when adopting a newer approved standard version

# or when compliance/security policy requires refreshing the pin.

don-petry · 2026-04-16T21:48:22Z

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: 5c0454a1595d0adfb375a43960a82b278c28661c
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

This PR pins a reusable workflow reference from a mutable @v1 tag to an immutable SHA (208ec2d69b75227d375edf8745d84fbac05a76b2), which is a security improvement satisfying the org's action-pinning compliance policy (issue #88). It also adds a boolean dry_run dispatch input and forwards it to the reusable workflow — a trivial, safe change. All CI checks pass (CodeQL, SonarCloud Quality Gate, AgentShield, CodeRabbit) with zero new issues or security hotspots.

Findings

Info

[info] .github/workflows/feature-ideation.yml:83 — Workflow reference changed from mutable @v1 tag to pinned SHA 208ec2d69b75227d375edf8745d84fbac05a76b2 — this is the correct, secure direction per the action-pinning policy. The # v1 comment preserves human-readable intent.
[info] .github/workflows/feature-ideation.yml:95 — dry_run input declared as boolean with default:false and forwarded via ${{ inputs.dry_run || false }}. The expression is safe — it is a typed boolean used as a reusable workflow with parameter, not interpolated into a shell command, so no injection risk exists.
[info] CI status — All status checks green: CodeQL SUCCESS, SonarCloud SUCCESS (0 new issues, 0 security hotspots), AgentShield SUCCESS, CodeRabbit SUCCESS. Merge is blocked only on missing approving review, not on failing checks.

CI status

All checks green: CodeQL, SonarCloud Quality Gate (0 new issues, 0 security hotspots), AgentShield, CodeRabbit. Branch is BLOCKED only pending an approving review.

Note: GitHub prevents self-approval; this verdict is posted as a comment. A human reviewer must click Approve to unblock merge.

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

Copilot AI review requested due to automatic review settings April 14, 2026 12:48

don-petry mentioned this pull request Apr 14, 2026

Compliance: unpinned-actions-feature-ideation.yml #88

Open

Copilot started reviewing on behalf of don-petry April 14, 2026 12:48 View session

Copilot AI reviewed Apr 14, 2026

View reviewed changes

don-petry enabled auto-merge (squash) April 16, 2026 21:48

Merge branch 'main' into claude/issue-88-20260414-1246

2573671

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: pin feature-ideation.yml reusable workflow to SHA#102

fix: pin feature-ideation.yml reusable workflow to SHA#102
don-petry wants to merge 2 commits intomainfrom
claude/issue-88-20260414-1246

don-petry commented Apr 14, 2026

Uh oh!

don-petry commented Apr 14, 2026

Uh oh!

sonarqubecloud Bot commented Apr 14, 2026

Uh oh!

coderabbitai Bot commented Apr 14, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

Copilot AI Apr 14, 2026

Uh oh!

don-petry commented Apr 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	dry_run: ${{ inputs.dry_run \|\| false }}
	dry_run: ${{ inputs.dry_run == true \|\| inputs.dry_run == 'true' }}

-      id-token: write
+      id-token: write
+    # Keep the reusable workflow path unchanged unless the standard itself moves.
+    # Update the pinned commit SHA when adopting a newer approved standard version
+    # or when compliance/security policy requires refreshing the pin.

Conversation

don-petry commented Apr 14, 2026

Summary

Uh oh!

don-petry commented Apr 14, 2026

Uh oh!

sonarqubecloud Bot commented Apr 14, 2026

Quality Gate passed

Uh oh!

coderabbitai Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

don-petry commented Apr 16, 2026

Automated review — APPROVED

Summary

Findings

Info

CI status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Apr 14, 2026 •

edited

Loading