[don-petry]

What

Two defects in the ci-failure-analyst job of .github/workflows/agent-ingress.yml. Both were carried over unchanged from the pre-collapse stub when markets#513 collapsed the roles:

1. Bare-SHA pin to channel. @b58510275dd1… # DEFECTIVE PIN becomes @ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref, matching how the other four roles pin their channels (markets ingress pins ci-failure-analyst by bare commit SHA (DEFECTIVE PIN): move it to a channel once stable is no longer frozen .github-private#2176).
   • The reusable at ci-failure-analyst/v1-stable (cc0bc61) has the same interface: the single required secret CLAUDE_CODE_OAUTH_TOKEN and job analyze.
   • It runs the same steps and loads no external prompts or scripts.
   • Its only difference from b585102 is a workflow-level permissions: block, which this job already grants.
2. Loop guard. !startsWith(check_run.name, 'CI Failure Analyst') becomes 'ci-failure-analyst'. The analyst's own check run is named ci-failure-analyst / analyze, so the old guard never matched, and a failed analyst run would re-trigger the analyst (ci-failure-analyst caller: the self-exclusion guard never matches a real check name, and no-PR failures still start the analyst .github-private#2175).

Checks

• scripts/validate-ingress-if.sh (from .github-private): OK.
• scripts/validate-caller-inputs.sh: OK. ci-failure-analyst@v1-stable resolves and its concurrency group does not collide with the reusable's.
• .github/scripts/tests/agent-ingress-workflow.bats: the two assertions that encoded the old values are updated. Two tests are added: one checks the guard prefix matches the real check name, and one checks the pin is the channel and carries no DEFECTIVE PIN marker.
• Job-block SHAs: dev-lead, pr-auto-review, pr-review and pr-review-mention are unchanged. ci-failure-analyst is now 4368213cf1825f4ff9c936b2a9340e95805a1acf. The canonical template in fix(standards): sync agent-ingress template job blocks to markets (pr-auto-review, pr-review, ci-failure-analyst) .github#1316 gets the identical block in the same window, so the Fleet Monitor classifies all five roles ALIGNED.

Refs combsmith/.github-private#1729, combsmith/.github-private#2176, combsmith/.github-private#2175

🤖 Generated with Claude Code

https://claude.ai/code/session_01Muchy4bnEhyVEnd89TUtjj

---

Generated by Claude Code

Problem

See the linked issue.

Risk

Medium — changes GitHub Actions workflow behavior, which is exercised only post-merge; verify via the affected workflow runs.

Test plan

Tests added/updated: .github/scripts/tests/agent-ingress-workflow.bats. Verification: bash scripts/dev-lead-lint.sh (shellcheck --severity=warning) ran pre-commit; the bats suite runs in CI.

Rollback

Revert this PR. No non-revertible side effects (no tags, migrations, or external state).

Monitoring

Watch the affected workflow run(s) in the Actions tab and this PR's Lint check for regressions.

Summary by CodeRabbit

• Chores
  • Updated the CI failure analyst workflow to use its stable release channel and consistently recognize its check-run names.
  • Added checks to verify the workflow’s channel and check-run matching.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T01:38:08.492351Z	dd038b3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: petry-projects/markets/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: f39daa26-91cb-482b-a66d-b470b69fa211

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 3d2db7e and dd038b3.

---

---

📒 Files selected for processing (2)

• .github/scripts/tests/agent-ingress-workflow.bats
• .github/workflows/agent-ingress.yml

---

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

The CI-failure-analyst job now uses a lowercase check-run prefix and the v1-stable reusable-workflow reference. Workflow tests assert the updated guard and reference.

Changes

Agent ingress analyst workflow

Layer / File(s)	Summary
Update analyst workflow guard and reference .github/workflows/agent-ingress.yml, .github/scripts/tests/agent-ingress-workflow.bats	The job excludes check runs with the ci-failure-analyst prefix and uses the ci-failure-analyst/v1-stable reference. Tests assert both values.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

---

---

Merge Risk: ⚪ Minimal · up to dd038

The analyst workflow now uses the stable channel and configured self-check prefix. The channel is compatible; the emitted check name remains unverified, but no concrete failure is established to block merging.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes both primary changes: pinning ci-failure-analyst to v1-stable and correcting the analyst loop guard.

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[gemini-code-assist]

Code Review

This pull request updates the ci-failure-analyst workflow pin to use a stable channel instead of a bare SHA, adjusts the loop guard check run name matching logic, and adds two new BATS tests to verify these behaviors. The review feedback suggests refactoring the newly added BATS test to use the run helper instead of a bare command-substitution assignment when extracting the prefix, ensuring any command failures are caught immediately.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #523
No changes were committed, but the PR still can't be marked done: required check SonarCloud is still pending. The retry cron will re-attempt automatically. Next attempt after: 2026-10-12T02:07:37Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but I can't mark it done yet: required check SonarCloud is still pending. I'll re-check automatically.
Next attempt after: 2026-10-12T02:07:37Z

[codeant-ai]

CodeAnt PR Risk: Medium Risk

• The PR needs attention before merging because it replaces an immutable workflow SHA with a movable channel ref.
• Changes to ci-failure-analyst/v1-stable can alter CI behavior without a change to this repository.

Assessed commit: dd038b34a24e

[don-petry]

The channel ref to ci-failure-analyst/v1-stable is intentional per CLAUDE.md: first-party channel tags are mutable refs and serve as the release/rollback mechanism. This follows the org's standard documented in AGENTS.md and is required for channel promotions to reach this repository without re-cutting the PR.