📄 CodeRabbit inference engine (.agents/governance/interviews/security-interview.md)

Review infrastructure code changes including GitHub Actions workflows, git hooks, and Dockerfile for security vulnerabilities

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/metrics/baseline-report.md)

Infrastructure files (including .githooks/pre-commit) must receive security review before deployment

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/metrics/dashboard-template.md)

Ensure infrastructure files in GitHub workflows directory are reviewed by agents with target rate of 100%

Implement full CodeRabbit enforcement for CI/CD workflow files in .github/workflows/ directory

Detect GitHub Actions workflow files (.github/workflows/*) as infrastructure changes requiring security and devops agent review

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/security/infrastructure-file-patterns.md)

GitHub Actions workflow files (.github/workflows/*.yml and .github/workflows/*.yaml) should trigger security agent review due to critical security implications

.github/workflows/*.{yml,yaml}: Infrastructure files (.github/workflows/) require devops and security agent review before commit
Add pre-commit validation that fails on infrastructure files (.github/workflows/) lacking security review documentation
Infrastructure files must include a security impact analysis document before creation or modification
Retroactive security review is required for quick-fix changes to workflow files made without pre-commit review
Workflow files must validate that all required permissions are explicitly declared and justified

Keep workflow YAML files light and thin - MUST NOT put complex logic in workflow YAML files; use thin workflows with calls to external testable modules or skills

.github/workflows/*.{yml,yaml}: Never use || true pattern without explicit error handling and ADR justification
Do not use || true error suppression in workflows without documenting rationale in an ADR

Use thin workflow pattern: minimize logic in YAML files, delegate complex operations to PowerShell modules

.github/workflows/*.{yml,yaml}: Use YAML heredoc with proper indentation for multi-line GitHub Actions values
Use GH_TOKEN for auto-authentication in GitHub Actions shell scripts
Use fixed-length lookbehinds for regex patterns in GitHub Actions
GitHub Actions outputs must be single-line format
Matrix jobs in GitHub Actions should use artifacts for output storage
Use environment variables for shell command interpolation in GitHub Actions to prevent injection vulnerabilities
Use verdict tokens for structured AI output in GitHub Actions
Format PR comments following CodeRabbit-style structured comment conventions

Implement GitHub Actions CI workflow to validate that HANDOFF.md is not modified on feature branch pull requests, preventing --no-verify bypass of pre-commit protection

I...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/analysis/pr41-issue-analysis.md)

.github/workflows/*.yml: Use dotnet-nunit reporter in dorny/test-reporter@v1 when Pester tests output NUnitXml format
Add explicit permissions block to GitHub Actions workflow jobs, specifying minimal required permissions (e.g., contents: read and checks: write for test reporting workflows)

.github/workflows/*.yml: Use minimal GitHub Actions permissions in CI workflows
Add workflow_dispatch trigger to GitHub Actions workflows for manual triggering capability
Add PowerShell-Yaml module installation step in CI workflows
Use ubuntu-latest for drift detection CI workflows for lighter weight execution
Add issue deduplication for drift alerts in GitHub Actions workflows
Use path filtering appropriately scoped in GitHub Actions workflows

CI/CD pipeline must include a drift-linting job that compares Claude agent content against generated VS Code and Copilot CLI variants on every PR modifying agent files

Create automated CI validation to detect absolute paths (Windows, macOS, Linux patterns) in markdown files with colored output, line numbers, and remediation steps

Configure concurrency groups in GitHub Actions workflows to prevent comment spam and race conditions when multiple commits trigger parallel workflow runs on the same PR

.github/workflows/*.yml: Remove silent || true error suppression from critical operations; instead track failures in arrays and provide summarized error reporting at workflow completion
Use minimal token scopes in GitHub Actions workflows: use repo scope for read-only operations, issues:write for issue modifications, and workflow permissions declarations following principle of least privilege

.github/workflows/*.yml: Store heredoc content in separate files instead of inline within YAML run: blocks to avoid YAML parsing errors when content lacks proper indentation
Use github.token (workflow's built-in token) for PR comments in GitHub Actions instead of service account PATs, as it automatically has write access t...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/retrospective/pr-feedback-remediation.md)

Use 'ubuntu-latest' for CI runner preference instead of 'windows-latest' for significantly faster performance, except for PowerShell Desktop or Windows-specific features

.github/workflows/**/*.{yml,yaml}: Workflows should be thin and contain only orchestration logic; all business logic (parsing, validation, formatting) must be extracted to PowerShell modules (.psm1)
Keep workflow YAML files to a maximum of 100 lines (orchestration only)
Do not parse complex strings (verdict, labels, etc.) in workflow YAML run: blocks; delegate to PowerShell modules
Do not validate business rules directly in workflow YAML; delegate to PowerShell modules
All PowerShell scripting for workflows must be PowerShell-only (no bash or other shell languages embedded in workflows)

.github/workflows/**/*.{yml,yaml}: PowerShell used consistently for label and milestone parsing in AI workflow (extract parsing logic to AIReviewCommon.psm1::Get-LabelsFromAIOutput rather than inline bash)
Use ::error:: GitHub Actions format for error output instead of echo or Write-Error to ensure errors are properly captured and cause workflow failure
Remove all '|| true' patterns and silent failure suppression in workflow steps - errors must be aggregated and reported explicitly using ::error:: format
Add token masking with ::add-mask:: before using secrets in workflow run steps to prevent accidental token leakage in logs
Replace secrets.BOT_PAT with github.token for issue and PR operations to minimize token privileges and reduce security attack surface
Document minimum required token scopes in workflow comments for each operation (e.g., 'repo' scope for issue edit and label application, 'read' scope for readonly operations)
Extract AI workflow parsing logic to testable PowerShell module functions (AIReviewCommon.psm1) rather than inline bash - enables unit testing in isolation and reduces regression risk

.github/workflows/**/*.{yml,yaml}: Use bash/PowerShell error collection pattern: initialize FAILED_...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/skills/ci-runner-preference.md)

**/.github/workflows/*.{yml,yaml}: Use ubuntu-latest (or linux-latest) runners for GitHub Actions workflows instead of windows-latest for better CI/CD pipeline performance
Only use windows-latest runner when PowerShell Desktop (5.1) is required, Windows-specific features are needed, or testing Windows-only scenarios
Prefer PowerShell Core (pwsh) over PowerShell Desktop for GitHub Actions scripts to enable cross-platform compatibility on Linux runners

Workflows SHOULD be less than 100 lines, containing orchestration only. Business logic SHOULD be extracted to PowerShell modules (.psm1).

Maintain consistent token scopes and authentication strategy throughout workflows; use the same token source for all related operations to avoid permission errors

**/.github/workflows/*.{yml,yaml}: Avoid code injection vulnerabilities by never directly interpolating unsanitized GitHub context variables (like ${{ github.event.issue.title }} or ${{ github.event.issue.body }}) into bash commands; instead save them to files using heredoc syntax and read them back
Use toJSON() to escape GitHub context variables when passing them to bash commands, or employ input validation before using variables in shell contexts
GitHub Actions workflows should request only the minimum necessary permissions (principle of least privilege) required for their operations

**/.github/workflows/*.{yml,yaml}: When ≥2 GitHub Actions workflows share logic, extract to composite action with parameterized inputs for reusability
GitHub Actions workflow files should include YAML syntax validation and actionlint checks in pre-commit configuration

**/.github/workflows/*.{yml,yaml}: Use artifacts instead of job outputs for passing data between matrix jobs in GitHub Actions workflows
Use environment variables for shell variable expansion in GitHub Actions instead of direct ${{ }} interpolation to prevent breaking shell when AI output contains quotes or special characters
Save findings from matr...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.github/instructions/security.instructions.md)

Use secure defaults and minimal exposure for security misconfiguration prevention

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

⚙️ CodeRabbit configuration file

.github/workflows/**: SECURITY-CRITICAL PATH - ASSERTIVE ENFORCEMENT
Review for: - Authentication and authorization (secrets handling, OIDC) - Credential exposure (env vars, git output, logs) - Injection vulnerabilities (command injection, script injection) - Race conditions (concurrent jobs, artifact operations) - Resource exhaustion (limits on runners, matrix expansions)
Flag: - Unquoted variables in shell commands - Direct use of user input in scripts - Missing error handling and early exit conditions - Hardcoded secrets or credentials - Unsafe use of 3rd party actions
DO NOT IGNORE any security-related findings on this path.

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/PR-60/001-pr-60-review-gap-analysis.md)

Use unique identifiers (e.g., run ID, timestamp) for temporary file paths in CI/CD workflows to prevent conflicts in concurrent runs on shared runners

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/PR-60/004-pr-60-devops-review.md)

Aggregate errors across workflow steps using error accumulation arrays and export failure summary via GITHUB_OUTPUT

.github/workflows/**/*.yml: GitHub Actions workflows orchestrating multiple agents should use matrix strategy with fail-fast: false to ensure all reviews complete
Use artifact passing (not job outputs) to transfer data between workflow jobs when using matrix strategy
Implement idempotency in workflow comment generation using comment markers to distinguish update vs create operations
Use skip optimization to check for docs-only changes before executing expensive AI review jobs
Add CI validation step to verify prompt templates include required output format markers before merging

.github/workflows/**/*.yml: Replace bash parsing with PowerShell functions in GitHub Actions workflows - use Get-LabelsFromAIOutput and Get-MilestoneFromAIOutput from AIReviewCommon.psm1 instead of bash grep/tr/xargs to prevent command injection (CWE-78) and word splitting vulnerabilities (CWE-20)
In GitHub Actions workflows parsing AI output, never use bash xargs, unquoted variable expansion, or for loops with simple string parsing - replace with PowerShell cmdlets that handle structured output safely
Verify PowerShell Core is available on GitHub Actions ubuntu-latest runner before using PowerShell in workflows

Add checkout step to skip-validation job in GitHub Actions workflows that use dorny/paths-filter

.github/workflows/**/*.yml: Add explicit exit 0 to PowerShell scripts in GitHub Actions workflow run blocks to prevent $LASTEXITCODE persistence
Validate GitHub labels exist before deploying workflows that reference them with gh pr edit --add-label
Add cross-platform validation matrix to test workflows or document single-platform requirements upfront when tests have platform assumptions

.github/workflows/**/*.yml: Use PowerShell call operator & for script invocations in GitHub Actions workflows to properly execute scripts by path
Scope GitHub Ac...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/PR-60/004-pr-60-implementation-review.md)

**/.github/workflows/**/*.yml: Replace bash label parsing in GitHub Actions workflows with PowerShell validation to prevent command injection via untrusted AI output
Validate all label strings against regex pattern '^[\w-.\s]{1,50}$' before applying to GitHub issues
Validate all category strings against regex pattern '^[\w-]{1,30}$' before using in workflow outputs
Validate all milestone strings against regex pattern '^[\w-.\s]{1,50}$' before assigning to issues
Use explicit error handling with informative error messages instead of '|| true' for GitHub CLI (gh) commands that should not fail silently
Keep '|| true' only for commands where empty/missing results are valid expected outcomes (e.g., grep with no matches, find with no results)
Verify GitHub CLI authentication status is successful before attempting API operations in CI workflows
Log validation rejections with details (invalid format, rejected label) for debugging label application failures
Provide detailed error messages in GitHub Actions workflow steps including context (what failed, why, what to check)
Use PowerShell 'Write-Host' with color output for structured workflow logging instead of plain echo statements
Use '|| true' in workflows only for commands where missing data is an expected valid state; document the reason in comments
Validate workflow inputs and outputs against strict regex patterns before using them in GitHub API commands

**/.github/workflows/**/*.yml: Use environment variables instead of direct ${{ }} template syntax in shell scripts to prevent shell injection attacks
Use artifacts instead of job outputs to pass data between matrix job legs, since outputs only expose one matrix leg
Prepare multi-line content via prior steps with GITHUB_OUTPUT heredoc syntax rather than attempting to execute shell commands in YAML with: inputs

**/.github/workflows/**/*.yml: Add explicit 'exit 0' at end of PowerShell workflow scripts to prevent $LASTEXITCODE persistence
Validate GitHub lab...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/PR-60/007-phase-1-detailed-schedule.md)

Use PowerShell-only code (no bash, Python, or shell scripts) with all workflow steps configured with 'shell: pwsh' per ADR-006

Use quoted heredoc (with 'EOF' delimiter) for safely handling github.event.pull_request.title and github.event.pull_request.body in bash env vars to prevent code injection

GitHub Actions workflows must use PowerShell functions from exported modules rather than inline bash parsing (grep/sed/tr) for consistent security and testability

In workflow comments, use explicit language about verdict behavior and consequences (e.g., 'should cause the check to FAIL (block merge)' rather than ambiguous phrasing)

**/.github/workflows/*.yml: Use PowerShell syntax (shell: pwsh) for GitHub workflow steps when handling untrusted AI output
Import PowerShell modules using correct relative path format (Import-Module .github/scripts/AIReviewCommon.psm1) in GitHub workflows to ensure module dependencies are properly resolved
Use PowerShell environment variables for all user input in GitHub workflows instead of direct bash variable interpolation to eliminate word-splitting vulnerabilities

Use $env:GITHUB_WORKSPACE with absolute paths instead of relative ./ prefix when importing PowerShell modules in GitHub Actions workflows

Include env: GH_TOKEN in workflow steps that use GitHub CLI to ensure proper authentication

**/.github/workflows/*.yml: GitHub Actions workflow JSON output consumption must use fromJson() to parse matrix data from upstream job outputs
GitHub Actions workflow matrix strategy should include max-parallel constraint to throttle concurrent job execution and respect API rate limits

Document all CI/CD workflow changes for backward compatibility verification in workflow recommendation documents

**/.github/workflows/*.yml: Add workflow input parameter to toggle alignment validation on/off for rollback scenarios without breaking CI
Embedding validation should run as separate independent workflow step, not integrated into Valid...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/pr-60-focused-plan.md)

Use sed with POSIX character classes instead of grep -P for regex patterns to ensure portability across Linux and macOS (grep -P is GNU-only)

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/pr-60-security-review.md)

.github/{workflows,scripts}/**/*.{yml,yaml,sh}: Avoid leaking sensitive information or internal configuration details in error messages and workflow logs that could be visible to attackers. Use generic error messages in production and reserve detailed diagnostics for debug logs only.
Sanitize and validate all untrusted user input (such as GitHub event data like PR titles, issue bodies, commit messages) before using in shell commands, API calls, or other operations that could interpret special characters.
When updating GitHub comments in workflows, use idempotent markers (HTML comments with unique identifiers) in comment bodies to enable safe updates by specific comment ID rather than relying on comment position.

Enforce ADR-005 with pre-commit hook rejecting bash in .github/workflows/ and .github/scripts/ directories

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-18-ai-workflow-implementation.md)

AI automation in CI/CD requires verdict tokens (PASS/WARN/CRITICAL_FAIL) for deterministic bash parsing without AI interpretation

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-04-ai-workflow-debugging.md)

Avoid explicit gh auth login --with-token when GH_TOKEN environment variable is already set, as gh CLI automatically uses the env var and will fail with exit code 1

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-13-workflow-lessons.md)

Use composite actions to encapsulate reusable workflow steps (Node.js/npm/Copilot CLI setup, authentication, agent loading, verdict parsing)

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-13-workflow-lessons.md)

Convert single-job loops to multi-job matrix structures (detect → validate → aggregate) for parallel validation with artifact passing

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-19-project-constraints.md)

Workflows must be thin and composed of testable, reusable modules

Follow Copilot follow-up PR naming convention: copilot/sub-pr-{original_pr_number} for branches targeting the original PR's base branch

**/.github/workflows/**/*.{yml,yaml}: Implement concurrency control using GitHub Actions concurrency group to prevent simultaneous PR maintenance runs
Configure GitHub Actions workflows to create an issue on failure with workflow diagnostics
Design thin GitHub Actions workflows that orchestrate logic rather than implementing testable module logic directly

**/.github/workflows/**/*.{yml,yaml}: Add workflow action steps AFTER parsing to apply suggested labels, assign suggested users, post feature review as comment, and update issue milestone based on recommendation
Specify exact line numbers and file locations in rollback plan, including which lines to remove from .github/workflows/ai-issue-triage.yml and triage summary PowerShell script
Include validation logic in workflow to verify that issue labels and analyst categorization match (e.g., if labeled 'enhancement', categorized as 'enhancement')
Specify Copilot model parameter in feature review workflow step (use claude-opus-4.5 for consistency with PRD generation step)
Define error handling for parse failures in workflow: specify fallback behavior when regex extraction fails (e.g., if recommendation returns UNKNOWN)
Verify category detection accuracy by testing whether analyst agent reliably categorizes feature requests, including false negative rate and fallback behavior for miscategorization

All workflow jobs must include explicit copilot-model parameter specification per governance requirements

**/.github/workflows/**/*.{yml,yaml}: Add LASTEXITCODE checks after each gh command in PowerShell scripts to detect and handle command failures instead of silently ignoring them
Implement pagination handling or document assumptions for GitHub API calls that may have limits (e.g., 100-commit pagination l...

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-18-session-34-pr-60-comment-response.md)

{.github/**/*.{sh,yml,yaml},**/*.sh}: Avoid gh auth login authentication patterns; use session-based authentication instead (reference Session 04 for implementation details)
Use secret masking for sensitive tokens like BOT_PAT in shell commands and CI/CD workflows

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/qa/057-pr-222-import-module-standardization.md)

Standardize Import-Module paths to use $env:GITHUB_WORKSPACE variable instead of relative paths

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-21-session-58-pr-141.md)

All skip jobs in workflows that document a checkout requirement must include the checkout step

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-22-pr-249-comprehensive-retrospective.md)

Parameterize branch references instead of hardcoding values like 'main' in workflow scripts and automation code

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-67-pr-249-review-response.md)

{**/.github/workflows/*.yml,**/*.ps1}: Default dry_run to true when inputs.dry_run is empty to prevent DryRun bypass for scheduled GitHub Actions runs
Allow protected branch checks to pass when GITHUB_ACTIONS=true to prevent CI workflow failures

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-72-pr-249-retrospective.md)

**/.github/workflows/*.{yaml,yml}: When workflow inputs are empty (scheduled triggers), default to fail-safe mode (dry_run=true) instead of fail-open
Explicitly declare environment variables (secrets, tokens) in each GitHub Actions workflow step that needs them, rather than relying on job-level inheritance

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-22-session-79-pr-268-review-response.md)

Use unique identifiers (such as issue numbers) in test cleanup operations to prevent race conditions across concurrent workflow runs

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-23-session-83-adr-017-quantitative-analysis.md)

Create CI validation for index ↔ atomic file consistency when implementing tiered index expansion

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/critique/001-pr365-remediation-critique.md)

Include note about URL staleness in CI/CD documentation that references specific run IDs, recommending use of dynamic commands (e.g., gh run list --branch <branch-name>) to find latest runs

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-23-session-85-pr-310-review.md)

Model routing for Copilot CLI must use evidence-aware, tiered routing: JSON extraction → gpt-5-mini, general review → claude-sonnet-4.5, security → claude-opus-4.5, code evidence → gpt-5.1-codex-max

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-23-session-90-adr-debate-clarification.md)

Aggregator model routing must be enforced via branch protection rules, not just code-level checks

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/analysis/ADR-023-related-work-research.md)

Validate matrix-level aggregation of Quality Gate failures to prevent masking of genuine failures

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/critique/001-issue-360-bot-loop-prevention-critique.md)

Align bot author classification in GitHub workflows with the bot categories defined in discovery scripts like Invoke-PRMaintenance.ps1 to maintain consistency across automation

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/qa/474-adr-numbering-final-verification.md)

{.agents/architecture/ADR-*.md,.github/workflows/**/*.yml}: Ensure runner selection references point to ADR-024 (GitHub Actions Runner Selection), not ADR-014 (Distributed Handoff Architecture)
Ensure ARM runner references point to ADR-025 (GitHub Actions ARM Runners), not ADR-014 (Distributed Handoff Architecture)

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/qa/474-adr-numbering-final-verification.md)

Preserve all existing references to ADR-014 (Distributed Handoff Architecture) in non-migration contexts, such as CI validation scripts, enforcement comments, and cost governance documentation

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/qa/468-pr-size-resilience-test-report.md)

**/{.github/workflows/*.{yml,yaml},**/*.psm1}: Use the GitHub Files API endpoint (repos/{owner}/{repo}/pulls/{pull_number}/files) instead of gh pr diff --name-only to handle large PRs (>20k lines) that fail with HTTP 406 errors
Use jq query .[].filename to extract filenames from GitHub Files API JSON response
Include the --paginate flag when calling the GitHub Files API to handle PRs with more than 100 files
Ensure environment variables like GITHUB_REPOSITORY, PR_NUMBER, and repository identifiers are properly set in the env block or function parameters before use in API calls
Add comments at each change site referencing the issue number (e.g., issue #468) to explain why the API replacement was necessary

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-28-session-critic-468-review.md)

{.github/workflows/*.yml,**/*.psm1,**/*.ps1}: Enable pagination when using GitHub REST API to list PR files to handle PRs with more than 100 files
Use the GitHub files API endpoint format gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" --paginate --jq '.[].filename' for fetching changed files in pull requests

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-29-session-96-issue-363-ai-reviewer-evaluation.md)

Configure AI reviewer bots (Copilot, cursor[bot]) with signal quality priority - maintain bots with >80% actionable comment rate

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/analysis/agent-skill-conversion-evaluation.md)

Create devops skill for pipeline generation and validation: enforce pipeline patterns, YAML structure validation, and security scanning in workflow files

.github/workflows/**/*.{yaml,yml}: Add id-token: write permission to GitHub Actions workflows when using OIDC authentication, as it is essential for the action to obtain an OIDC token for app token exchange
Implement author association guards in GitHub Actions workflows to restrict external trigger execution, ensuring only trusted contributors (OWNER, MEMBER, COLLABORATOR) can trigger sensitive operations
Use explicit bot allowlists instead of wildcards in GitHub Actions workflows to control which bots are permitted to perform sensitive operations
Request contents: write permission in GitHub Actions workflows when performing branch or commit operations
Request issues: write and pull-requests: write permissions in GitHub Actions workflows when performing issue or PR operations
Document the rationale and source (e.g., official action documentation) when implementing security-critical permissions in GitHub Actions workflows

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-29-session-98-issue-146-skip-tests-xml-powershell.md)

Follow ADR-005 (PowerShell only) constraint - do not use bash heredocs or inline shell scripts for test result generation

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-29-session-97-issue-163-job-retry.md)

.github/**/*.{yml,yaml}: Maintain MAX_RETRIES=2 setting (allowing initial attempt plus 2 retries for 3 total attempts) in CI retry implementations
Implement exponential backoff delays when retrying failed jobs: first attempt immediate (0s), subsequent retries with increasing delays (30s, 60s)

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/sessions/2025-12-30-session-109-claude-sessions-analysis.md)

Maintain pre-commit and CI validation parity—do not allow validation rules to diverge between pre-commit checks and CI pipeline

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/retrospective/2025-12-31-pr-co-mingling-analysis.md)

Add explicit branch verification check to all commit workflows in project configuration

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/architecture/ADR-035-exit-code-standardization.md)

Bash and workflow callers of PowerShell scripts must be updated to handle the exit codes defined in ADR-035 (0=success, 1=logic error, 2=config error, 3=external error, 4=auth error)

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/analysis/session-recommendations-overlap-research.md)

Maintain pre-commit and CI validation parity to prevent validation gaps in session protocols

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/security/SR-036-adr-architecture-review.md)

Implement CI validation gate that regenerates all agents and compares output to committed files, failing CI if generated output differs

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/critique/ADR-007-analyst-independent-review.md)

Validate memory index consistency in CI: Verify index ↔ file relationships and memory title/content alignment to prevent memory corruption propagation

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/critique/DESIGN-REVIEW-pr-60-remediation-architecture.md)

.github/workflows/**.yml: All workflow steps that parse JSON output from GitHub API or AI models must use PowerShell with ConvertFrom-Json rather than bash with jq or regex, for type safety and maintainability
Limit bash usage in GitHub workflows to simple operations only: npm install, git commands, environment variable exports, and simple gh CLI command invocations without output processing

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/devops/ci-analysis-pr737-session-validation.md)

Avoid eval, dynamic code execution, and string interpolation in shell commands; use parameter passing and type-safe constructs instead

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml

📄 CodeRabbit inference engine (.agents/planning/slashcommandcreator-implementation-plan.md)

CI/CD workflow logic MUST be placed in reusable PowerShell modules (following ADR-006: thin workflows, logic in modules) located in scripts/modules/, not inline in YAML workflow files.

Files:

• .github/workflows/droid-review.yml
• .github/workflows/droid.yml