MPT-22385 Add Danger PR-formatting check workflow

[d3rky]

🤖 AI-generated PR — Please review carefully.

What

Add .github/workflows/danger.yml running the shared softwareone-platform/one-danger@1.1.0 action on pull requests. It enforces the PR-formatting rules (Jira key in title, single commit, size threshold, no merge commits, release-branch markers and release→main linkage) via Danger.

Part of the org-wide rollout (US-3); the same workflow was smoke-tested in mpt-extension-sdk.

Jira

Closes MPT-22385 (subtask of MPT-22376).

Testing

This PR triggers the new Danger workflow on itself.

Closes MPT-22385

• Add GitHub Actions workflow to enforce organizational PR-formatting rules using the shared softwareone-platform/one-danger@1.1.0 action
• Enforce Jira key requirement in PR titles, single commit policy, PR size thresholds, and prevention of merge commits
• Validate release-branch markers and release-to-main branch linkage as part of organization-wide standardization rollout

[coderabbitai]

📝 Walkthrough

Walkthrough

A new GitHub Actions workflow .github/workflows/danger.yml is added. It triggers on pull_request events (opened, synchronize, reopened, edited), grants read access to contents and write access to pull-requests, and runs the softwareone-platform/one-danger@1.1.0 action with full repository history and GITHUB_TOKEN.

Changes

Danger CI Workflow

Layer / File(s)	Summary
Workflow trigger, permissions, and job definition .github/workflows/danger.yml	New workflow triggered on pull request lifecycle events with scoped permissions. A single danger job checks out the repo with full history (fetch-depth: 0) and executes softwareone-platform/one-danger@1.1.0 using GITHUB_TOKEN.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Documentation Up To Date	⚠️ Warning	PR adds Danger workflow enforcing PR-formatting rules (developer workflow change) but docs/contributing.md doesn't document the new workflow or its requirements.	Update docs/contributing.md to document the Danger workflow, PR-formatting rules (Jira key, single commit, size threshold, etc.), and how it affects the developer workflow.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Pr And Commit Formatting	✅ Passed	PR meets formatting requirements: single commit with Conventional Commits format (ci: add Danger PR-formatting check), body explaining changes, linear history without merges, and PR description cla...

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

✅ Found Jira issue key in the title: MPT-22385

Generated by 🚫 dangerJS against 4f09987

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/danger.yml (1)

17-22: ⚡ Quick win

Pin external actions to immutable commit SHAs.

Using mutable tags (@v6, @1.1.0) increases supply-chain risk. Pinning to SHAs hardens the workflow without changing behavior.

Suggested hardening diff

-      - name: Checkout
-        uses: actions/checkout@v6
+      - name: Checkout
+        uses: actions/checkout@<resolved_checkout_sha>

       - name: Run Danger
-        uses: softwareone-platform/one-danger@1.1.0
+        uses: softwareone-platform/one-danger@<resolved_one_danger_sha>

Use the release/tag refs only to resolve the SHA once, then pin the SHA in workflow.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/danger.yml around lines 17 - 22, The GitHub Actions
workflow is using mutable version tags (v6 and 1.1.0) for external actions,
which creates supply chain security risks. Replace the mutable tags with
immutable commit SHAs for both the actions/checkout and
softwareone-platform/one-danger actions. First resolve the commit SHA for each
action version, then update the workflow to reference the SHAs directly instead
of the version tags. This ensures the workflow will always use the exact same
version of each action regardless of any future tag changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/danger.yml:
- Around line 17-22: The GitHub Actions workflow is using mutable version tags
(v6 and 1.1.0) for external actions, which creates supply chain security risks.
Replace the mutable tags with immutable commit SHAs for both the
actions/checkout and softwareone-platform/one-danger actions. First resolve the
commit SHA for each action version, then update the workflow to reference the
SHAs directly instead of the version tags. This ensures the workflow will always
use the exact same version of each action regardless of any future tag changes.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 0f22f917-abfe-4258-bf8b-58da9178d91f

📥 Commits

Reviewing files that changed from the base of the PR and between d1370e6 and 4f09987.

📒 Files selected for processing (1)

• .github/workflows/danger.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• softwareone-platform/mpt-extension-skills (manual)

📜 Review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: build

🔇 Additional comments (1)

.github/workflows/danger.yml (1)

17-17: No issues found. The actions/checkout@v6 tag is valid and published; the workflow will not fail due to a missing tag.