chore: bump dependabot-rebase reusable to current main SHA

[don-petry]

Bumps the dependabot-rebase-reusable.yml caller from the stale @v1 tag to the current main SHA of petry-projects/.github.

The @v1 tag points to an old commit that lacks:

• Fallback @dependabot rebase comment for branches with workflow files (403 workaround)
• Re-approval after update-branch to satisfy require_last_push_approval
• Correct if CMD=$(cmd); then ... else ... fi pattern (bash -e bug fix)
• contents: write + pull-requests: write job-level permissions (required for reusable to write)

This is a routine maintenance bump — no behaviour changes needed in this repo.

[coderabbitai]

Warning

Rate limit exceeded

@github-actions[bot] has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 44 minutes and 22 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 44 minutes and 22 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f28680f9-1295-456c-b7a5-1c2438549e4e

📥 Commits

Reviewing files that changed from the base of the PR and between bca8483 and c3cd18f.

📒 Files selected for processing (1)

• .github/workflows/dependabot-rebase.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/bump-dependabot-rebase-sha

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the repository’s Dependabot rebase workflow caller to reference a pinned SHA of the org-level reusable workflow, aiming to bring the repo in sync with the current implementation in petry-projects/.github.

Changes:

• Update the reusable workflow reference from @v1 to a specific commit SHA.
• Adjust the caller job’s permissions to contents: write and pull-requests: write.
• Replace secrets: inherit with explicit secret mappings and add a workflow_dispatch trigger.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The header comment says you “MUST NOT change: trigger event …”, but this PR adds workflow_dispatch below. Either remove the new trigger to match the stated constraint, or update this guidance to reflect the intended trigger set (and why it’s allowed).

[Copilot]

PR description says this is a routine SHA bump with “no behaviour changes needed in this repo”, but this workflow change also (1) adds a new workflow_dispatch trigger and (2) changes job permissions/secrets wiring. If these are intentional as part of the upgrade, please update the PR description to match; otherwise keep the change limited to the uses: ref as described.

[don-petry]

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: 6613f25a3a58b9b65eb102508f77881ef5866fa1
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Note: Approval posted as comment — GitHub does not allow approving your own PR.

Summary

Single-file GHA caller stub update: bumps reusable workflow reference from mutable @v1 tag to a pinned SHA (security improvement), upgrades permissions from read→write (necessary for update-branch + re-approve operations), and replaces secrets:inherit with explicit APP_ID/APP_PRIVATE_KEY mapping (security improvement). All CI checks pass (CodeQL, SonarCloud, AgentShield) and the PR author is the org owner.

Findings

Info

• [info] .github/workflows/dependabot-rebase.yml:42 — SHA pinning (9a694e579...) replaces mutable @v1 tag — supply-chain security improvement. SHA cannot be independently verified by this reviewer but author is the org owner and all security scanners passed.
• [info] .github/workflows/dependabot-rebase.yml:43 — Replacing secrets: inherit with explicit APP_ID + APP_PRIVATE_KEY mapping is a security improvement — it narrows the secret surface exposed to the reusable workflow.
• [info] CI — Branch is BEHIND main (mergeStateStatus: BEHIND). Not a blocker — update-branch handles this, and the workflow itself manages rebases for Dependabot PRs.
• [info] CI — All required CI checks passed: CodeQL (SUCCESS), SonarCloud (SUCCESS, 0 issues, 0 hotspots), AgentShield (SUCCESS). Dependency audit and Backend/Frontend CI skipped (no relevant files changed).

Minor

• [minor] .github/workflows/dependabot-rebase.yml:40 — Job permissions elevated from contents:read/pull-requests:read to contents:write/pull-requests:write. Intentional and documented (update-branch + re-approve flow); reusable workflows cannot exceed caller-job permissions, so scope is bounded to this repo's GITHUB_TOKEN.
• [minor] .github/workflows/dependabot-rebase.yml:44 — APP_PRIVATE_KEY is passed to an external reusable workflow. Risk is mitigated by SHA pinning (prevents tag-moving attack) and the reusable is in the same org (petry-projects/.github). All CI security scanners returned clean.

CI status

All required checks passed: CodeQL ✓, SonarCloud ✓ (0 issues), AgentShield ✓. Branch is behind main — update-branch will be triggered automatically.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Automated review — APPROVED

Risk: MEDIUM
Reviewed commit: e9b78e6b6fcf996bf20bf6692eda4726dfd15566
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)

Summary

Single-file GHA caller stub update: bumps reusable reference from mutable @v1 tag to a pinned SHA (supply-chain improvement), elevates job permissions read→write (required for update-branch + re-approve flow), and replaces secrets:inherit with explicit APP_ID/APP_PRIVATE_KEY mapping (reduces secret surface). All CI security checks pass (CodeQL, SonarCloud, AgentShield). Triage escalated due to a technical failure (triage-output-invalid), not a substantive security signal. Risk is MEDIUM but all gates pass — approving.

Findings

Info

• [info] .github/workflows/dependabot-rebase.yml:42 — SHA pinning (9a694e5798ebb596476e6eda80f11e832d8fd0a9) replaces mutable @v1 tag — prevents tag-moving supply chain attack. SHA cannot be independently verified by this reviewer but CodeQL and AgentShield security scanners both passed clean.
• [info] .github/workflows/dependabot-rebase.yml:43 — Replacing secrets: inherit with explicit APP_ID + APP_PRIVATE_KEY mapping is a security improvement — narrows the secret surface exposed to the reusable workflow from all repo secrets to just two named secrets.
• [info] CI — All required CI checks passed: CodeQL (SUCCESS), SonarCloud (SUCCESS, 0 issues, 0 hotspots), AgentShield (SUCCESS), CodeRabbit (SUCCESS). mergeStateStatus is BLOCKED pending review approval — not a failing check.

Minor

• [minor] .github/workflows/dependabot-rebase.yml:40 — Job permissions elevated from contents:read/pull-requests:read to contents:write/pull-requests:write. Intentional and clearly documented in inline comments — required for update-branch and re-approve operations. Reusable workflows are bounded by caller-job permissions, so scope is limited to this repo's GITHUB_TOKEN.
• [minor] .github/workflows/dependabot-rebase.yml:44 — APP_PRIVATE_KEY is passed to an external reusable workflow in petry-projects/.github. Risk is mitigated by SHA pinning (prevents tag-moving attack) and the reusable lives in the same org. All CI security scanners returned clean.

CI status

All required checks passed: CodeQL ✓, SonarCloud ✓ (0 issues, 0 hotspots), AgentShield ✓, CodeRabbit ✓. Branch is BLOCKED pending review approval only.

---

Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.