From cbc60016d19d13f55ae2ecc5b658f1b356ed0cc8 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 28 Jul 2026 18:52:06 +0000 Subject: [PATCH 1/3] =?UTF-8?q?feat:=20implement=20issue=20#495=20?= =?UTF-8?q?=E2=80=94=20SonarCloud:=20miscellaneous=20findings?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/pr-auto-review.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index 4bc47dda..d23301e0 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -28,9 +28,9 @@ on: # workflow_run fires when a named GitHub Actions workflow completes. # check_suite does NOT trigger for GitHub Actions runs, so this is required # to catch CI turning green on a PR. - # TODO: replace "CI" with your repository's CI workflow name(s). workflow_run: - workflows: ["CI"] + workflows: + ['CI Pipeline', 'Node.js Tests', 'Coverage', 'Playwright UI Tests'] types: [completed] # check_suite covers third-party CI checks (e.g. SonarCloud, external apps). check_suite: @@ -50,7 +50,7 @@ jobs: pull-requests: read checks: read actions: read - uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/pr-auto-review-reusable.yml@pr-auto-review/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref secrets: # Canonical-first fallback (.github-private#1326). The reusable resolves this # secret BY NAME, so only the VALUE changes — the passed key stays named From 24b4015f6e0dbb859fe26dbaf20d96d8880aa74a Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 28 Jul 2026 18:53:18 +0000 Subject: [PATCH 2/3] chore(ci): apply prettier/eslint auto-fixes --- .github/workflows/add-to-project.yml | 2 +- .github/workflows/auto-rebase.yml | 6 +++--- .github/workflows/dependabot-automerge.yml | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index d5b20a58..0c1d6e71 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -47,7 +47,7 @@ jobs: add-to-project: permissions: contents: read - uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref + uses: petry-projects/.github/.github/workflows/add-to-project-reusable.yml@add-to-project/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref with: project_id: PVT_kwDOD2inqs4BZq3- project_url: https://github.com/orgs/petry-projects/projects/1 diff --git a/.github/workflows/auto-rebase.yml b/.github/workflows/auto-rebase.yml index ec4140e2..0e27df89 100644 --- a/.github/workflows/auto-rebase.yml +++ b/.github/workflows/auto-rebase.yml @@ -48,7 +48,7 @@ permissions: {} jobs: auto-rebase: permissions: - contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) + contents: write # update-branch via GITHUB_TOKEN (may touch .github/workflows/) pull-requests: write # post comments on PRs - uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable + uses: petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@auto-rebase/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index eddb767e..040a578e 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref - secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/v2-stable # NOSONAR(githubactions:S7637) first-party channel ref + secrets: inherit # NOSONAR(githubactions:S7635) first-party trusted reusable From b1906ff3ef03e3b312adfb0784b3a0d240ec1684 Mon Sep 17 00:00:00 2001 From: Rachel Petry Date: Sat, 1 Aug 2026 20:45:08 -0500 Subject: [PATCH 3/3] fix: add AgentShield and Dependency audit to pr-auto-review workflow_run allowlist Sync the readiness-gate trigger with main and merge in upstream changes. The allowlist previously omitted two required-check workflows, so the readiness gate never re-evaluated if either was the last check to finish. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/pr-auto-review.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pr-auto-review.yml b/.github/workflows/pr-auto-review.yml index d23301e0..65a0cf03 100644 --- a/.github/workflows/pr-auto-review.yml +++ b/.github/workflows/pr-auto-review.yml @@ -30,7 +30,14 @@ on: # to catch CI turning green on a PR. workflow_run: workflows: - ['CI Pipeline', 'Node.js Tests', 'Coverage', 'Playwright UI Tests'] + [ + 'CI Pipeline', + 'Node.js Tests', + 'Coverage', + 'Playwright UI Tests', + 'AgentShield', + 'Dependency audit', + ] types: [completed] # check_suite covers third-party CI checks (e.g. SonarCloud, external apps). check_suite: