ci: make root action defaults safe

[roli-lpci]

Summary

• make root-action repair and PR-comment behavior explicit opt-ins
• exercise the ordinary smoke path without either input and verify tracked consumer source/status remain unchanged
• retain explicit deterministic repair-success and repair-escalation cases
• document workspace mutation and pull-requests: write requirements in the security policy

Why

The Marketplace root action previously defaulted to mutating the consumer workspace and attempting PR comments. That required surprising write permissions and made a default invocation unsafe for least-privilege CI. The default smoke cases now omit both inputs entirely, matching the public defaults; only the repair cases pass repair: "true".

Scope

This PR is limited to the root action defaults, its clean-consumer smoke workflow, and SECURITY.md. It does not change the legacy nested action, history discovery, full-mode dependencies, releases, or other action defaults.

Validation

• actionlint .github/workflows/action-smoke.yml
• exact action-manifest, output-reference, SHA-pin, default-input, and read-only-permission assertions
• ruff check src/ tests/
• ruff format --check src/ tests/
• pyright src/
• python -m pytest -q — 158 passed
• git diff --check

Acceptance evidence

• default smoke invocations omit repair and post-comment
• smoke workflow has only contents: read permissions
• default cases assert clean tracked status and both staged/unstaged diffs after action execution
• explicit repair-success remains covered with repair: "true"

[coderabbitai]

Warning

Review limit reached

@roli-lpci, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Limit details: You’ve used all 3 included reviews currently available under your plan.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f14324e-0e08-4631-935b-dba1d8a425d3

📥 Commits

Reviewing files that changed from the base of the PR and between 4683c27 and 3e2af38.

📒 Files selected for processing (3)

• .github/workflows/action-smoke.yml
• SECURITY.md
• action.yml

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PyGate Quality Gate Results

PyGate Agent Brief — run_20260817214619_0e92d920

Mode: canary
Status: fail
Summary: 6 deterministic finding(s) require repair.

Findings & Actions

pyright_reportReturnType_tests/action-fixture/fail.py_2

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: single_file
• Files: tests/action-fixture/fail.py
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

pyright_reportMissingImports_tests/conftest.py_6

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: single_file
• Files: tests/conftest.py
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

pyright_reportMissingImports_tests/test_cli.py_6

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: single_file
• Files: tests/test_cli.py
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

pyright_reportMissingImports_tests/test_edge_cases.py_14

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: single_file
• Files: tests/test_edge_cases.py
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

pyright_reportMissingImports_tests/test_models.py_5

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: single_file
• Files: tests/test_models.py
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

pyright_reportMissingModuleSource_tests/test_primitive_contract.py_10

• Action: Resolve Pyright type errors for impacted files and re-run typecheck.
• Scope: single_file
• Files: tests/test_primitive_contract.py
• Rationale: typecheck failed deterministically. Address this before any inferred optimizations.

Retry Policy

• Max attempts: 3
• Max patch lines: 150
• Abort on no improvement: 2 consecutive attempts

Escalation

• Required: True
• Reason: UNRESOLVED_DETERMINISTIC_FAILURES
• Message: Escalate with evidence packet if bounded repair loop cannot clear deterministic failures.