fix(standards): sync agent-ingress template job blocks to markets (pr-auto-review, pr-review, ci-failure-analyst)

Merged
DO
7d ago
+15-11

Refs petry-projects/.github-private#1729

Brings the pr-auto-review, pr-review and ci-failure-analyst job blocks in standards/workflows/agent-ingress.yml into byte-for-byte alignment with petry-projects/markets main @ 9310b6e6 (petry-projects/markets#523 merged, ingress blob a0c97e13), so the Fleet Monitor's per-job block hashes line up (dry run 38150568552 flagged them as DRIFTED). Header, on:, permissions:, dev-lead, pr-review-mention and the comment lines between jobs are unchanged. Nothing was added to DEPLOYABLE_WORKFLOWS, and no deploy script or test was changed.

Block SHAs: PR head 4cdd886 vs markets main @ 9310b6e (extract_job_block / job_block_sha)

jobthis PRmarkets main
dev-lead4f0b41d30fd3e5deaae4bc81168fb2d19d15b7be4f0b41d✅
pr-auto-review69e0115529e9be36b07ebd809a50ccc54c4a733469e0115✅
pr-reviewe14fb0468d7332f03544ddfb9e11c41d5508b2f8e14fb04✅
pr-review-mentiond21265d143601abf0d84d07badba0189d03b6026d21265d✅
ci-failure-analyst4368213cf1825f4ff9c936b2a9340e95805a1acf4368213✅

Validation

  • bats -r test/scripts/{standards-templates,deploy-standard-workflows,compliance-audit}: all pass, including the vform-pins guard and the "agent-ingress.yml must never appear in DEPLOYABLE_WORKFLOWS" guard.
  • yamllint with the CI config: clean.

Reviewer notes

  • ci-failure-analyst pin (owner decision): always a release channel, never a bare SHA. The template and markets main both use @ci-failure-analyst/v1-stable # NOSONAR(githubactions:S7637) first-party channel ref.
  • ci-failure-analyst loop guard (petry-projects/.github-private#2175): !startsWith(check_run.name, 'CI Failure Analyst') never matched the analyst's own check runs (ci-failure-analyst / …). It now uses 'ci-failure-analyst', the same as markets.
  • ci-failure-analyst secrets: the explicit CLAUDE_CODE_OAUTH_TOKEN mapping is kept on purpose for least privilege. It is unchanged from the original stub and markets.
  • pr-auto-review concurrency change: the group changes from per-head-SHA (pr-auto-review-ready-check-sha-…) to per-event-id (check_suite.id / workflow_run.id, with a 'none' fallback).
  • Auto-merge is off and dev-lead:hands-off is applied. The owner will merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B3euCoLvC3YmanzKoc4hox