ci: schedule hourly NVIDIA NIM commercial maintenance

[seonghobae]

Summary

Add NewsDOM's leaf adapter for the organization-owned hourly PR maintenance control plane.

• run every hour at minute 41 with repository-scoped single-flight concurrency;
• inspect at most 50 open develop PRs and dispatch at most one repair;
• pin the reusable central workflow to immutable commit 2ebda8063d3c541e2552dc474c3c8601ddc986f8;
• route repair inference through the central OpenCode worker backed by NVIDIA_NIM_API_KEY;
• keep COPILOT_GITHUB_TOKEN, model credentials, code-write permission, approvals, merges, releases, and branch-protection changes out of the leaf workflow;
• provide manual dry-run mode, static contract tests, operations documentation, and a CHANGELOG entry.

MSA boundary

NewsDOM retains only target repository, develop branch, cadence, and queue limits. Review parsing, exact-head validation, GitHub App token exchange, model configuration, file allowlisting, and repair behavior remain centrally owned by ContextualWisdomLab/.github. The service continues to work independently and as a naruon-compatible PDF-to-DOM sidecar.

Merge contract

This workflow cannot merge its own work. Any repair produces a new head that must pass the existing 100% coverage/docstring gates, security workflows, exact-head OpenCode/Noema review, and protected-branch approval requirements.

Verification

• focused caller contract tests;
• full repository tests and 100% production coverage;
• workflow syntax/actionlint;
• exact-head required security checks and independent review;
• one post-merge manual dry run before relying on the schedule.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 44 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 99add5e9-a269-4b01-ba08-dbbd8c7640c8

📥 Commits

Reviewing files that changed from the base of the PR and between 2af8b7a and 2786508.

📒 Files selected for processing (5)

• .github/workflows/hourly-commercial-maintenance.yml
• CHANGELOG.md
• docs/operations/hourly-commercial-maintenance.md
• tests/test_hourly_commercial_maintenance.py
• tests/test_workflow_runtime_env.py

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Drafted because the caller’s immutable pin 2ebda8063d3c541e2552dc474c3c8601ddc986f8 belongs to closed, unmerged central PR #778 and diverges from protected .github/main; enabling this schedule would execute an abandoned control-plane revision. Keep this PR draft until the replacement central NVIDIA NIM repair workflow lands on protected main. Then update the workflow, contract test, documentation, and PR body to the final reachable commit SHA; rerun all exact-head checks and independent review; perform one manual dry_run; only then restore Ready/auto-merge. The current leaf head’s nine workflows are green and review threads are resolved, but those results cannot validate a future central pin.

[seonghobae]

Closing this draft as superseded by the current protected-main central integration path in ContextualWisdomLab/.github#782. The leaf currently pins commit 2ebda806... from closed, unmerged central predecessor #778, so merging it would activate a non-canonical scheduler implementation and duplicate ownership before the reviewed NVIDIA NIM worker reaches the protected central default branch. Recreate the four-file NewsDOM caller on the exact merged central SHA after #782 passes current-head checks, independent approval, and protected merge.

[seonghobae]

Closing this leaf caller because its immutable reusable-workflow pin points to commit 2ebda8063d3c541e2552dc474c3c8601ddc986f8 from central PR #778, which closed without merge and is not present on the protected central default branch. A scheduled workflow must not depend on an unmerged, closed control-plane commit. The branch is preserved. After the replacement central NVIDIA NIM repair workflow is merged and its final protected-main SHA is known, NewsDOM will recreate a clean caller from current develop, pin that merged SHA, rerun exact-head workflow/security contracts, and then activate the hourly schedule without COPILOT_GITHUB_TOKEN or changes to the existing reviewer credential chain.