ci: agentic workflow to keep PRs rebased (gh-aw)

[igorpecovnik]

Adds a GitHub Agentic Workflow (githubnext/gh-aw) that keeps open PRs rebased on the default branch — per the GitHub Agentic Workflows model. Source is keep-prs-rebased.md; the compiled keep-prs-rebased.lock.yml is committed alongside (gh-aw convention, gh aw compile).

What it does

• Triggers: daily (04:00 UTC) + manual workflow_dispatch.
• For each open, non-draft, same-repo PR labelled keep-rebased that's behind the default branch: rebase onto the default branch and push the result back via the push-to-pull-request-branch safe output.
• On unresolvable conflicts: abort, don't push, and leave a comment (add-comment safe output) asking for a manual rebase.
• Engine: claude (uses ANTHROPIC_API_KEY, already used by reporting-release-summary.yml).

Safety model (why this is low-risk)

• Opt-in per PR: nothing happens unless a PR carries the keep-rebased label — the label is enforced both in the prompt and by the push-to-pull-request-branch safe output. No PRs have it yet, so merging this is inert until you label one.
• No fork writes: the safe output rejects fork PRs by design.
• Read-only agent: permissions: contents: read, pull-requests: read; the agent never writes to GitHub directly — all writes go through the sanitized safe-outputs job.
• Scheduled runs only fire on the default branch, so this does nothing until merged.

Security review (required by gh-aw safe-update)

• Secrets: ANTHROPIC_API_KEY — already present and used by this repo; no new external secret. gh-aw's GH_AW_* tokens fall back to GITHUB_TOKEN.
• Actions: all pinned by commit SHA — actions/checkout, actions/cache, actions/download-artifact, actions/upload-artifact, actions/github-script, actions/setup-node, github/gh-aw-actions/setup.
• Containers: GitHub's official gh-aw runtime (firewall/mcp/node), pinned by digest.
• Network: network: defaults (gh-aw egress allowlist/firewall).
• I reviewed each of the above; nothing exfiltrates credentials or reaches unexpected hosts.

Notes / knobs

• To make it non-opt-in (rebase all open PRs), drop required-labels: [keep-rebased].
• Compiler warns the fixed 04:00 cron could be a fuzzy daily to spread load — left as-is for predictability.
• Alternative if you'd rather merge base in than rebase (GitHub-native, never force-pushes): switch to the update-pull-request: { update-branch: true } safe output. Say the word and I'll swap it.

Opened as draft for review since it force-pushes to PR branches.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e92c3da1-c650-403a-bd56-27bc53eeabee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-keep-prs-rebased-agentic-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}