[ricardofrantz]

Changes:

• review-gate.yml (waits for the CodeRabbit and cubic check runs on the head commit; fails if cubic did not complete or CodeRabbit was off or errored; warns when CodeRabbit is rate limited or skips a later push after a finished review) and scorecard.yml (OpenSSF Scorecard, weekly, SARIF upload); permissions are least-privilege and every action is pinned to a full commit SHA, same files as machine-made/pi-effort
• cooldown default-days 7 on each Dependabot update entry (uv's exclude-newer fails Dependabot jobs on releases younger than 7 days)

Summary by CodeRabbit

• Chores
  • Automated dependency updates now wait seven days before opening update requests.
  • Pull requests are checked for completed automated reviews, with incomplete or unsuccessful reviews causing the check to fail.
  • A scheduled and on-demand security scorecard check now reports findings to code scanning.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The changes add 7-day Dependabot cooldowns, a pull request workflow that evaluates CodeRabbit and cubic checks, and a Scorecard workflow that uploads SARIF results to code scanning.

Changes: Dependency update cooldowns

Layer / File(s)	Summary
Set default cooldowns .github/dependabot.yml	The GitHub Actions and uv update configurations each set a 7-day default cooldown.

Pull request review gate

Layer / File(s)	Summary
Configure the review gate .github/workflows/review-gate.yml	The workflow sets pull request triggers, permissions, concurrency, timeout, and skip conditions. Shell helpers query current and historical check runs.
Poll and evaluate checks .github/workflows/review-gate.yml	The workflow polls CodeRabbit and cubic checks. It applies completion, failure, warning, and notice rules.

Scorecard workflow

Layer / File(s)	Summary
Run and publish Scorecard results .github/workflows/scorecard.yml	The workflow runs Scorecard, stores SARIF results as a five-day artifact, and uploads them to code scanning.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other

Merge Risk: Minimal · up to e6b9b

This PR adds CI automation: a review gate, a weekly Scorecard run, and 7-day Dependabot cooldowns. No concrete merge-blocking problem was found. The gate's behavior on reopened PRs depends on vendor timing that could not be confirmed.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title names three changes: review-gate, OpenSSF Scorecard, and Dependabot cooldown. The raw summary covers all three: the review-gate workflow, the Scorecard workflow, and the 7-day cooldown in de…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title names three changes: review-gate, OpenSSF Scorecard, and Dependabot cooldown. The raw summary covers all three: the review-gate workflow, the Scorecard workflow, and the 7-day cooldown in dependabot.yml. The title is a single line, uses the conventional commit prefix, and matches the PR objectives. It lists three items rather than the single most important change, which is acceptable.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 390d6c7f-d711-4681-bed3-c1b431f19bdc

Commits

Reviewing files that changed from the base of the PR and between 6936588 and e6b9bd6.

Files selected for processing: 3

• .github/dependabot.yml
• .github/workflows/review-gate.yml
• .github/workflows/scorecard.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Re-trigger cubic</sub>