feat: implement issue #414 — Compliance: non-stub-feature-ideation.yml

[don-petry]

Closes #414

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 8 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fb3c459d-b5fd-46c8-a4fc-c814140f5c56

📥 Commits

Reviewing files that changed from the base of the PR and between e0331d9 and 628cefb.

📒 Files selected for processing (1)

• .github/workflows/feature-ideation.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-414-20260703-1423

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates the repo’s .github/workflows/feature-ideation.yml to match the centralized “thin stub” caller pattern for the org-wide Feature Ideation reusable workflow, addressing the compliance finding in #414.

Changes:

• Adds workflow_dispatch inputs for enhance_backlog and target_discussion.
• Introduces a discussion:created → workflow_dispatch “redispatch” bridge job so the reusable runs under a supported event context.
• Updates the reusable workflow pin and routes target_discussion / enhance_backlog through with: inputs.

[don-petry]

Fixed in .github/workflows/feature-ideation.yml line 68: changed the enhance_backlog input description from double-quoted to single-quoted style, with the apostrophe in repo's escaped as repo''s per YAML single-quote escaping rules. This matches the canonical org template verbatim to avoid textual-diff compliance flags.

[don-petry]

Correction to my prior reply: the single-quote form with '' escaping was applied, but the mandatory npx prettier --write . pass (required by AGENTS.md) immediately normalized it back to double quotes. Prettier chooses double quotes for YAML strings that contain an apostrophe even when singleQuote: true is set in .prettierrc, because the '' escape sequence is valid YAML but less readable. The semantic content is identical either way. If the compliance check compares files textually against the org template, the fix would need to land in Prettier's YAML formatter or the org template should be canonicalized through this repo's Prettier config first — both would converge to the same double-quote form. The file is currently in the Prettier-canonical form that passes npm run check.

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 628cefbc643a5fa433aa08c528d45853a6209a0d
Review mode: triage-approved (single reviewer)

Summary

Replaces the repo's feature-ideation.yml with the canonical org stub per compliance finding #414. Verified byte-for-byte against standards/workflows/feature-ideation.yml: identical except line 68, where Prettier normalized the enhance_backlog description from single-quoted (with '' escape) to double-quoted — semantically identical YAML. The new SHA pin e20a8fac matches the template's own pin. The new redispatch bridge job is well-hardened (permissions: {}, env-var quoting, PAT used only for gh workflow run, mirrors the established initiative-planner pattern). Escalating (not approving) because one review thread is unresolved and it carries a real residual question about whether the compliance audit will re-flag the file.

Linked issue analysis

Issue #414 (compliance: non-stub-feature-ideation.yml) requires copying the canonical template verbatim with the reusable pinned per org standard. The PR does exactly this — the file matches the template except the one Prettier-normalized quote style on line 68. Substantively addressed; whether the audit's comparison method (textual vs. semantic) accepts the quote difference is the open question.

Findings

1. Unresolved review thread (blocking approval). Copilot flagged that line 68 diverges textually from the org template (double vs. single quotes). The author explained that the mandatory npx prettier --write . pass forces double quotes for YAML strings containing an apostrophe. The thread is answered but not resolved, and the underlying question is real: if the weekly compliance audit compares files textually, it will re-flag this file every week. This needs an org-level decision — either canonicalize the org template through Prettier or make the audit comparison semantic. Recommend resolving the thread with that decision before merge.
2. SHA pin verified via API. e20a8fac1b6a10bd6ad0999258e88a423f890ba6 exists in petry-projects/.github (2026-06-26) and matches the pin inside the canonical template itself. Note the v1 git tag currently points to d3d768da — the template's pin is treated as authoritative per the remediation instructions.
3. Redispatch job security review: clean. permissions: {}, discussion number passed via env var and quoted, PAT (GH_PAT_WORKFLOWS) scoped to a single gh workflow run call, bot-authored discussions filtered. No injection surface; no new trigger exposure beyond the pre-existing discussion: created trigger.
4. Secret-scan MCP tool unavailable in this run; gitleaks CI check passed (SUCCESS).

CI status

All substantive checks green: build-and-test, Node.js Tests, Playwright, coverage, CodeQL (actions/js-ts/python), SonarCloud (quality gate passed, 0 new issues), gitleaks, AgentShield, dependency-audit. Two dev-lead agent runs show CANCELLED — concurrency cancellations of automation runs, not code-check failures. Merge state BLOCKED pending required review.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.