Repository navigation
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe feature ideation workflow adds dispatch inputs, redispatches Ideas discussions into workflow runs, normalizes parameters in a preparation job, and forwards typed values and discussion targets to the reusable workflow. ChangesFeature ideation routing
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Discussion as GitHub Discussion
participant Redispatch as redispatch job
participant Dispatch as workflow_dispatch run
participant Prep as prep job
participant Ideate as ideate reusable workflow
Discussion->>Redispatch: discussion: created in Ideas
Redispatch->>Dispatch: dispatch with target_discussion
Dispatch->>Prep: resolve workflow inputs
Prep->>Ideate: pass typed parameters and target
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #350 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
There was a problem hiding this comment.
Pull request overview
Aligns the repo’s feature-ideation.yml with the org’s centralized Feature Ideation workflow stub pattern so the BMAD Analyst ideation pipeline runs via the reusable workflow and supports discussion-triggered “single idea enhancement” via redispatch.
Changes:
- Adds
enhance_backlogandtarget_discussionworkflow inputs and refines thediscussion: createdtrigger documentation. - Introduces a
discussion→workflow_dispatchredispatch bridge plus aprepjob to safely resolve inputs for the reusable call. - Updates the reusable workflow reference to use a first-party “stable channel” ref and passes parameters via
needs.prep.outputs.*(including boolean casting).
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/feature-ideation.yml:
- Line 185: Update the reusable workflow reference in the feature ideation
workflow to use the required immutable channel ref `@v1` instead of the mutable
`@feature-ideation/stable`, and remove the NOSONAR suppression attached to that
line. Keep the canonical reusable workflow reference otherwise unchanged.
- Around line 147-164: Update the “Resolve dispatch inputs” step’s GITHUB_OUTPUT
writing so the free-text FOCUS_AREA value uses the heredoc delimiter format
rather than plain key=value output, preserving embedded newlines without
creating unintended output keys. Keep the existing defaults and scalar output
handling unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 2284fb4d-3211-4d1f-b3c9-83af743d25c4
📒 Files selected for processing (1)
.github/workflows/feature-ideation.yml
| id-token: write | ||
| actions: read | ||
| uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@49ecdfb72d1378864fd6263b0fb94c23626f554a # v1 | ||
| uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Reusable ref not pinned to @v1 — contradicts this PR's stated compliance objective.
The PR objectives explicitly require the reusable workflow reference to be pinned to petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1, and to copy the canonical template verbatim. This line instead points at a mutable branch (@feature-ideation/stable) and adds a NOSONAR suppression for the pinning lint rule. A floating branch ref for a workflow that runs with discussions: write and id-token: write permissions can change underneath this repo without review, undermining exactly the supply-chain guarantee compliance issue #301 is meant to enforce.
🔒 Proposed fix
- uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref
+ uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel ref | |
| uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@v1 |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/feature-ideation.yml at line 185, Update the reusable
workflow reference in the feature ideation workflow to use the required
immutable channel ref `@v1` instead of the mutable `@feature-ideation/stable`,
and remove the NOSONAR suppression attached to that line. Keep the canonical
reusable workflow reference otherwise unchanged.
There was a problem hiding this comment.
Skipping this change: @feature-ideation/stable is a first-party channel tag — an intentional mutable ref per AGENTS.md "Release channel tags & the mutable-ref exception". The pattern petry-projects/.github/.github/workflows/*.yml@<agent>/<channel> is the org's release/rollback mechanism and must not be pinned to @v1 or a commit SHA. The # NOSONAR suppression is correct and remains. If the compliance audit still expects @v1, the issue/standard should be updated to reflect that channel refs are the authorised pattern.
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== AGENTS files =='
fd -HI '^AGENTS\.md$' . -x sh -c 'echo "--- $1"; rg -n -C 4 -i "release channel|mutable.ref|feature-ideation/stable|NOSONAR|workflow.*ref" "$1" || true' sh {} \;
printf '%s\n' '== Related policy references =='
rg -n -i -C 4 'Release channel tags|mutable-ref exception|feature-ideation/stable|first-party channel' \
-g 'AGENTS.md' -g '*.md' -g '*.yml' -g '*.yaml' .Length of output: 808
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '== Root AGENTS.md =='
cat -n AGENTS.md
printf '%s\n' '== Additional scoped AGENTS.md files, if any =='
fd -HI '^AGENTS\.md$' . -x sh -c '
[ "$1" = "./AGENTS.md" ] && exit 0
echo "--- $1"
cat -n "$1"
' sh {}Length of output: 1294
🤖 web_search executed:
Fetch and quote the section of https://github.com/petry-projects/.github/blob/main/AGENTS.md covering “Release channel tags & the mutable-ref exception”, including the allowed reusable GitHub Actions workflow reference pattern and any Sonar/NOSONAR guidance.
Length of output: 19050
🏁 Script executed:
#!/bin/bash
set -euo pipefail
policy_file="$(mktemp)"
trap 'rm -f "$policy_file"' EXIT
curl --fail --silent --show-error --location \
'https://raw.githubusercontent.com/petry-projects/.github/main/AGENTS.md' \
-o "$policy_file"
printf '%s\n' '== Relevant organization policy sections =='
rg -n -i -C 12 \
'release channel|mutable.ref|internal reusable workflow references|first-party|channel ref|NOSONAR|workflow pinning' \
"$policy_file" || trueLength of output: 640
🏁 Script executed:
#!/bin/bash
set -euo pipefail
template_file="$(mktemp)"
trap 'rm -f "$template_file"' EXIT
curl --fail --silent --show-error --location \
'https://raw.githubusercontent.com/petry-projects/.github/main/standards/workflows/feature-ideation.yml' \
-o "$template_file"
printf '%s\n' '== Canonical template identity and reusable reference =='
rg -n -C 4 \
'SOURCE OF TRUTH|^name:|^\s*uses:\s*petry-projects/\.github/\.github/workflows/feature-ideation-reusable\.yml@|NOSONAR' \
"$template_file"Length of output: 2115
@don-petry, confirmed. The current canonical standards/workflows/feature-ideation.yml uses the exact same reference on Line 185:
uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/stable # NOSONAR(githubactions:S7637) first-party channel refThis PR therefore copies the canonical template correctly. My finding was invalid and should be withdrawn. The stated @v1 objective is stale or inconsistent with the current standard and should be updated separately.
🐇
✏️ Learnings added
Learnt from: don-petry
Repo: petry-projects/markets PR: 350
File: .github/workflows/feature-ideation.yml:185-185
Timestamp: 2026-07-21T05:35:01.322Z
Learning: For `.github/workflows/feature-ideation.yml`, the canonical template in `petry-projects/.github/standards/workflows/feature-ideation.yml` intentionally delegates through `petry-projects/.github/.github/workflows/feature-ideation-reusable.ymlfeature-ideation/stable` with `# NOSONAR(githubactions:S7637) first-party channel ref`. This first-party release-channel reference is canonical and must not be changed to `v1` or a commit SHA during template adoption.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #350 |
|
Closing as part of the 50-PR cap drain. The dev-lead fix-loop repairs #1340 (self-cancellation), #1290 (comment-inertness) and #806 (thread-resolution) have all landed, so this deadlocked PR can be regenerated cleanly through the repaired loop. The driving issue stays open and its dev-lead label is re-fired — no work is lost. |
Closes #301
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit