[don-petry]

Problem

Compliance: stub-surface-drift-pr-auto-review.yml-concurrency

From the issue: Category: ci-workflows Severity: warning Check: stub-surface-drift-pr-auto-review.yml-concurrency

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

No test files were added or updated. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the existing CI (bats + lint) guards the change.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

Closes #501

Summary by CodeRabbit

• Chores
  • Check-suite and workflow-completion events now share a run group based on the first associated pull request and cancel in-progress runs in that group. Events without an associated pull request use a unique run group.
  • Pull request and review events use unique run groups and no longer cancel in-progress runs.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #502
No changes were committed, but the PR still can't be marked done: required check SonarCloud is still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-09-25T18:24:09Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required check SonarCloud is still pending. I'll re-check automatically.
Next attempt after: 2026-09-25T18:24:09Z

[don-petry]

No description provided.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

• Configuration used: Repository: petry-projects/markets/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 15589ed7-2703-476e-bd80-35858deef82c

📥 Commits

Reviewing files that changed from the base of the PR and between 8b7cc17 and 1a9871d.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: petry-projects/markets/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: b3bb1a8e-2292-46e2-b1fd-ff24671789fe

📥 Commits

Reviewing files that changed from the base of the PR and between c6014ba and 8b7cc17.

📒 Files selected for processing (1)

• .github/workflows/pr-auto-review.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/pr-auto-review.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflow groups check_suite and workflow_run events by the first associated PR number, or by run ID if no PR is associated. It uses unique run-ID groups for pull_request and pull_request_review events. Cancellation applies only to check_suite and workflow_run events.

Changes

PR auto-review concurrency

Layer / File(s)	Summary
Event concurrency rules .github/workflows/pr-auto-review.yml	check_suite and workflow_run events share a concurrency group when they have an associated PR, using the first associated PR number. If neither event has an associated PR, the workflow uses a run-ID group. pull_request and pull_request_review events use run-ID groups. Cancellation applies only to check_suite and workflow_run events.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 8b7cc

The workflow concurrency change is ready to merge after normal checks; no actionable mismatch remains in the inspected block.

Architecture Summary

Architecture risk: 🔵 Low · up to c6014

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/pr-auto-review.yml: The concurrency comments now describe deduplication for default-branch-context events, the unique-run fallback for zero or multiple associated PRs, and the non-cancelling, unique-run treatment of PR-head events.
• observed — Modified behavior in .github/workflows/pr-auto-review.yml: The group expression now groups check_suite and workflow_run by PR number only when exactly one associated PR exists; otherwise it uses the run ID. pull_request and pull_request_review no longer share per-PR groups. Cancellation now applies only to check_suite and workflow_run, rather than to the PR-head events.

🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	#501 requires the concurrency surface in .github/workflows/pr-auto-review.yml to match standards/workflows/pr-auto-review.yml verbatim. The PR changes the event-specific grouping and cancellatio…	Provide the canonical standards/workflows/pr-auto-review.yml concurrency block, or equivalent reviewable evidence of that block, to determine whether the PR meets #501.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title identifies the compliance change to the pr-auto-review.yml concurrency configuration. It is longer and less readable than preferred, but it clearly describes the main change.
Out of Scope Changes check	✅ Passed	The whole-PR diff changes only concurrency logic and related comments in .github/workflows/pr-auto-review.yml. These changes directly address #501. No unrelated changes appear in the reviewed diff.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

Full details: Linked Issues check

Explanation

#501 requires the concurrency surface in .github/workflows/pr-auto-review.yml to match standards/workflows/pr-auto-review.yml verbatim. The PR changes the event-specific grouping and cancellation rules, but the canonical workflow is not available in the reviewed repository evidence. I cannot confirm whether the revised block matches it.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: 9191a5d1d2dd19f7d4299457e0ca3a10a2637129
Review mode: triage-approved (single reviewer)

Summary

Compliance standards-sync PR: re-syncs the centrally-owned concurrency block of the pr-auto-review.yml caller stub to the canonical standards/workflows/pr-auto-review.yml. Verified byte-identical to the canonical standard; the only residual file difference is an allowed repo-specific comment (CI workflow name annotation). Triage's low-risk assessment is confirmed.

Linked issue analysis

Issue #501 (compliance finding stub-surface-drift-pr-auto-review.yml-concurrency) requires re-syncing the concurrency: surface verbatim from standards/workflows/pr-auto-review.yml. Verified: fetched the canonical template and the PR head file — the concurrency block matches byte-for-byte. Closes #501 is appropriate; merging resolves the finding.

Findings

• Trusted first-party stub / standards-sync carve-out applies: single changed file is the .github/workflows/pr-auto-review.yml caller stub, PR is a dev-lead compliance remediation, no secrets touched, no third-party reusable added. Rated on content: MEDIUM (non-trivial CI concurrency logic change, but a verbatim copy of the sanctioned standard).
• Concurrency semantics checked: check_suite/workflow_run with an associated PR collapse to a per-PR group with cancel-in-progress; events with no associated PR and all pull_request/pull_request_review events fall back to unique-per-run groups (never cancelled). Expression precedence (&& over ||) yields the intended fallback chain; empty pull_requests[] safely falls through to the unique group.
• One unresolved codeant-ai thread (COMMENTED, not a change request) flags pull_requests[0] indeterminacy when multiple PRs share a completion. This tradeoff is explicitly adopted by the centrally-owned canonical standard (superseding is safe because these runs do not attach checks to the PR head); the concern belongs against the standard in petry-projects/.github, not this verbatim sync — deviating here would re-trigger the drift finding.
• Secret scan: run_secret_scanning MCP tool unavailable in this environment; gitleaks CI check passed (SUCCESS). Diff contains no secret-like content.
• No auth/permissions changes (permissions: {} untouched), no new triggers, no dependency changes.

CI status

All required checks pass: CodeQL, SonarCloud (x2), agent-shield / AgentShield, dependency-audit / Detect ecosystems. Also green: gitleaks secret scan, pr-auto-review dispatch, SonarCloud quality gate, Graphite AI review. Pending items are optional third-party AI reviewers (cubic, CodeRabbit) and the dev-lead dispatch loop awaiting this review — none are required checks.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

[don-petry]

Acknowledged — this is a Qodo trial-ended/billing notice, not a code finding. No action required in this PR; resuming Qodo reviews is a workspace-admin billing task outside this PR's scope.

[don-petry]

Acknowledged — Gemini reports it cannot review this PR because the only changed file is a GitHub Actions workflow YAML, an unsupported file type. This is an informational limitation with no action required; the workflow change was reviewed via the codeant-ai thread instead.

[don-petry]

Acknowledged — SonarCloud's Quality Gate passed for this PR. Informational status report, no action required.

[don-petry]

Acknowledged — this is CodeRabbit's auto-generated PR summary/overview, which describes the diff rather than raising an actionable finding. No change requested and none made in response; the substantive review item (concurrency grouping) was addressed via the codeant-ai review thread.

[don-petry]

Dev-Lead — fix-reviews (applied)

Changes committed and pushed. Requested items addressed:

• .github/workflows/pr-auto-review.yml:65 — applied

[don-petry]

Dev-Lead — waiting on PR blockers (intent: fix-reviews)

PR: #502
No changes were committed, but the PR still can't be marked done: required checks SonarCloud, agent-shield / AgentShield are still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-09-25T18:30:53Z

[don-petry]

No description provided.

[don-petry]

Acknowledged — SonarCloud reports the Quality Gate passed for this PR (0 new issues, 0 security hotspots, 0 duplication on new code). Informational status notice, no action required.

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 0 review threads (open threads list is empty).
Phase 1b — PR issue comment dispositions:
- Comment IC_kwDORntvTc8AAAABW-qoYg (sonarqubecloud): informational — SonarCloud Quality Gate passed notice, acknowledged, no action needed [disposition posted]
Skipped (already minimized/RESOLVED): qodo billing notice, gemini unsupported-filetype notice, coderabbit summary
Skipped (our own automation markers): all don-petry dev-lead-* status/guard/ack comments and prior dev-lead:comment-disposition replies
Tier-1 blockers: none (all CI checks success/skipped; cubic + CodeRabbit still in_progress but neither is a required/failing check; no CHANGES_REQUESTED reviews)
Test verification: n/a — no code changed
Files changed: none
```
No commit was made (no code change was required); the disposition reply is the only action, and the harness will minimize the SonarCloud comment once it verifies the marker.

[cubic-dev-ai]

Review completed against the latest diff

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[don-petry]

No description provided.

[don-petry]

No description provided.

[don-petry]

No description provided.

[don-petry]

No description provided.

[don-petry]

No description provided.

[don-petry]

No description provided.

[don-petry]

Dev-Lead — fix-reviews (no-changes)

Agent reasoning

Addressed 0 threads with code changes. I deferred the one open thread to a tracking issue.
- Thread PRRT_kwDORntvTc6opZaN: deferred. The multi-PR grouping under `pull_requests[0]` is a deliberate tradeoff in the canonical `pr-auto-review.yml` that this PR syncs verbatim (#501). Editing it here would re-trigger the drift finding, so the change belongs upstream in `petry-projects/.github`. I created the tracking issue "dev-lead: deferred review findings" (#519, none existed), linked the thread there, and replied with the deferral marker (`ref=#519`). The reply carries no addressed-marker.
**CI:** The only non-green check is `review / review`, which was cancelled. It looks like a superseded run rather than a code failure, and it needs no code change. I didn't check why it was cancelled.
**Issue comments:** I didn't enumerate or disposition PR issue comments.
**Review states:** No review is in `CHANGES_REQUESTED`.
Test verification: not run, since there were no code changes.
Files changed: none.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Dev-lead rebase: this PR can't be rebased into a non-empty change. main deleted .github/workflows/pr-auto-review.yml in #513 (ADR-0007, collapsed into agent-ingress.yml), and every commit on this branch only modifies that file. Resolving each modify/delete conflict as a deletion drops all 4 commits, leaving the branch identical to main. I did not force-push. The concurrency change for #501 would need re-applying to agent-ingress.yml if still wanted; otherwise this PR can be closed as superseded.

🤖 Generated with Claude Code

[don-petry]

No-op fix detected — human attention needed

The rebase pass reverted this PR's own changes, so its net diff against main is now empty (zero changed files). Merging a PR that nets to zero would auto-close its Closes #N compliance issue while the underlying finding remains unfixed (#1340), and the idempotent audit would immediately re-open it.

Auto-merge has been disabled and no commit was pushed. A human should restore the correct fix or close this PR.

[don-petry]

Closing as superseded by #513 (ADR-0007 collapse, merged 2026-10-10). That PR deleted .github/workflows/pr-auto-review.yml; the role now runs as the pr-auto-review job in .github/workflows/agent-ingress.yml, with its own job-level concurrency under ADR-0010. This PR edits a file that no longer exists on main. Rebasing it while keeping its side would re-add the stub next to the ingress, and every pr-auto-review event would then run twice.

---

Generated by Claude Code