feat: implement issue #227 — Compliance: check-suite-auto-trigger-347564#271
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Warning Review limit reached
More reviews will be available in 16 minutes and 32 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Author
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
There was a problem hiding this comment.
Pull request overview
Adds an automated cadence to re-apply repository settings so the repo stays compliant (and avoids settings drift that can reintroduce blocked/never-completing check suites like the CodeRabbit auto-trigger finding in #227).
Changes:
- Extend the
Apply repo settingsworkflow to also run on a weekly cron schedule. - Ensure updates to the workflow file itself trigger a settings re-application on push.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This was referenced Jun 10, 2026
donpetry-bot
previously approved these changes
Jun 16, 2026
donpetry-bot
left a comment
donpetry-bot
left a comment
Contributor
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: ed68e84319eba088fb93892f60487d5f8ef578bf
Review mode: triage-approved (single reviewer)
Summary
Adds a weekly cron and a self-path-trigger to the Apply repo settings workflow. Merging this PR triggers the workflow (the workflow file now matches its own push-path filter), which runs scripts/apply-repo-settings.sh to disable the CodeRabbit (app 347564) check-suite auto-trigger flagged in #227, and the weekly cron re-enforces settings to prevent future drift.
Linked issue analysis
Issue #227 reports the CodeRabbit (app 347564) auto-trigger creating queued check suites that never complete, permanently blocking auto-merge. apply-repo-settings.sh PATCHes /check-suites/preferences to set auto_trigger_checks false for app 347564 (and 1236702), directly remediating the finding. Adding .github/workflows/apply-repo-settings.yml to the push-path filter means merging this PR re-runs that script on main, applying the fix immediately; the new weekly cron (Mon 03:00 UTC) catches drift between compliance audits. Substantively addressed.
Findings
- No blocking issues. permissions stays {} at top level with administration:write scoped only to the apply job (pre-existing). Checkout action remains SHA-pinned. No untrusted-input interpolation in run steps; no injection or loop risk (push-to-main only, workflow makes no commits). Cron expression '0 3 * * 1' correctly matches the 'Mon 03:00 UTC' comment.
- Non-blocking note: issue #227's manual remediation mentions an admin PAT, while the workflow uses secrets.GITHUB_TOKEN with administration:write. This is pre-existing (unchanged by this PR); if GITHUB_TOKEN were insufficient, existing push-triggered runs would already fail.
CI status
All required checks green (AgentShield, gitleaks, CodeQL actions+python, SonarCloud, dependency-audit detect, dev-lead dispatch, pr-auto-review). Remaining entries are SKIPPED (no matching ecosystem/relay), no failures.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
This was referenced Jun 17, 2026
Contributor
Author
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
27 similar comments
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
Contributor
|
@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes. |
don-petry
added a commit
that referenced
this pull request
Jun 23, 2026
…564 (#271) * Initial commit * Install BMad Method v6.2.0 with Claude Code integration Sets up BMad Method (Agile AI-Driven Development framework) with the BMM module, 36 skills and 9 agents configured for Claude Code. https://claude.ai/code/session_01VY2xiQ7rg51abGxTBCfcVj * fix: configure CodeQL to scan Python only (#6) * fix: add CodeQL workflow targeting Python only * fix: add contents:read permission for checkout step * chore: add ECC integration, TEA module, and slim CLAUDE.md - Slim CLAUDE.md from 22KB to 12KB by extracting enforcement rules into references (ECC rules installed globally via ~/.claude/rules/) - Add ECC-for-BMad integration guide (docs/ecc-for-bmad.md) - Install BMad TEA (Test Architect) module with 9 testing workflows (ATDD, automate, CI, framework, NFR, test-design, test-review, trace, teach-me-testing) plus TEA agent persona - Register TEA workflow skills in .claude/skills/ for Claude Code access - Update BMad core to v6.2.2 (restructured _bmad/ directory layout) - AgentShield security scan: Grade A (100/100) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#15) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#22) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#18) - Scope workflow token permissions to read-all with per-job overrides (#19) - Pin all GitHub Action dependencies to commit SHAs (#20) - Ensure SAST (CodeQL) runs on all push commits to main (#21) Closes #18, #19, #20, #21 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.1 (#27) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#24) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#28) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#30) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#26) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#34) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bee87b3...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#48) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#49) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#61) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#62) * chore: add CODEOWNERS file for code review enforcement Adds .github/CODEOWNERS assigning @don-petry as default code owner for all files, satisfying the compliance requirement for code owner review enforcement on pull requests. Closes #47 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * fix: rename codeql workflow and add javascript-typescript + actions matrix (#81) - Rename codeql-analysis.yml → codeql.yml (compliance: exact filename required) - Replace Python with javascript-typescript (matches TalkTerm stack) - Add actions language scan (required: repo has .github/workflows/*.yml) - Use matrix strategy for multi-language scanning per ci-standards.md - Update schedule to Friday 17:00 UTC per org standard Closes #41 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#82) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: correct reusable workflow path (remove duplicate .github/) (#135) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#135)" This reverts commit 2f121a1. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(ci): remove stray codeql.yml workflow (#115) The org now uses GitHub-managed CodeQL default setup. The per-repo codeql.yml was drift and ran a duplicate analysis alongside default setup. Removing it per the org standard. Closes #96 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(security): remove drift codeql.yml, enable GitHub-managed default setup (#117) Per org CI standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. Per-repo codeql.yml files are treated as drift by the compliance audit. Actions taken: - Removed .github/workflows/codeql.yml (drift per-repo advanced setup) - Re-confirmed default setup via API: state=configured, query_suite=default The GitHub-managed default setup is already running CodeQL scans. The compliance audit 403 is a PAT scope issue in the audit bot (needs Administration:read scope on the audit bot token in petry-projects/.github). Closes #95 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(ci): pin agent-shield reusable workflow to SHA (#126) Pins agent-shield-reusable.yml@v1 to its full commit SHA (ee22b427cbce9ecadcf2b436acb57c3adf0cb63d) to satisfy the org-wide action-pinning policy. Closes #85 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: add bot accounts to CODEOWNERS for auto-merge support * chore: standardize CODEOWNERS on @petry-projects/org-leads (#160) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#176) * feat: implement issue #162 — Compliance: codeowners-no-catchall (#182) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #175 — Compliance: non-stub-pr-review-mention.yml (#185) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #161 — Compliance: codeowners-org-leads-not-first (#189) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #200 — [Fleet Monitor] petry-projects/TalkTerm — dev-lead.yml (#202) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #86 — Compliance: unpinned-actions-claude.yml (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #163 — Compliance: check-suite-auto-trigger-1236702 (#206) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#236) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #272 — Compliance: dev-lead-stub-pin (#297) * feat: implement issue #272 — Compliance: dev-lead-stub-pin * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #217 — Compliance: codeowners-org-leads-not-first (#270) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci(dev-lead): pin caller to @dev-lead/ring1 (staged canary) (#306) * ci(dev-lead): pin caller to @dev-lead/ring1 (staged canary ring) * fix(security): suppress gitleaks false positives for commit c5099d1 Adds .gitleaksignore fingerprints for commit c5099d1 which contains the same SHA256 content checksums in _bmad/_config/files-manifest.csv that have been documented as false positives in five prior commits. The generic-api-key rule flags high-entropy hex strings; these are file-content checksums, not credentials. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #227 — Compliance: check-suite-auto-trigger-347564 Pin org reusable workflows to @v1 (agent-shield, dependabot-automerge, dependency-audit) and reinforce repo settings via a weekly schedule plus self-path trigger and a concurrency group on apply-repo-settings. Closes #227 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(secret-scan): suppress gitleaks false positives in commit 38e9f74 Added suppression for commit 38e9f74 which contains the same _bmad/_config/files-manifest.csv CSV rows (SHA256 checksums of BMAD skill files, not API keys) as previously-reviewed commits. Gitleaks generic-api-key rule flags high-entropy hex strings; these are file-content checksums, not credentials. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(secret-scan): suppress additional gitleaks false positive in da36d9b Commit da36d9b contains the same false-positive generic-api-key findings in _bmad/_config/files-manifest.csv (lines 281, 282, 284, 300, 409, 433) as earlier commits. These are SHA256 file-content checksums in a manifest CSV, not API keys. Adding them to .gitleaksignore to resolve the full-history gitleaks enforcement check failure. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(bot): address bot feedback [skip ci-relay] * fix(secret-scan): suppress remaining gitleaks false positives Gitleaks full-history enforcement (CLI scan) found 11 unflagged fingerprints in two commits: - f57f035: rebase/merge copy of "chore: add ECC integration, TEA module, and slim CLAUDE.md" — all 6 lines (281, 282, 284, 300, 409, 433) in _bmad/_config/files-manifest.csv were unregistered. - 3d0fa15: same commit message variant — lines 281, 282, 284, 300, 409 were missing; only line 433 had been suppressed. All findings are SHA256 content checksums in the BMAD files-manifest CSV, not real credentials. Same false-positive rationale as the previously suppressed entries above them in .gitleaksignore. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Root <donpetry@users.noreply.github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Jun 23, 2026
…564 (#271) * Initial commit * Install BMad Method v6.2.0 with Claude Code integration Sets up BMad Method (Agile AI-Driven Development framework) with the BMM module, 36 skills and 9 agents configured for Claude Code. https://claude.ai/code/session_01VY2xiQ7rg51abGxTBCfcVj * fix: configure CodeQL to scan Python only (#6) * fix: add CodeQL workflow targeting Python only * fix: add contents:read permission for checkout step * chore: add ECC integration, TEA module, and slim CLAUDE.md - Slim CLAUDE.md from 22KB to 12KB by extracting enforcement rules into references (ECC rules installed globally via ~/.claude/rules/) - Add ECC-for-BMad integration guide (docs/ecc-for-bmad.md) - Install BMad TEA (Test Architect) module with 9 testing workflows (ATDD, automate, CI, framework, NFR, test-design, test-review, trace, teach-me-testing) plus TEA agent persona - Register TEA workflow skills in .claude/skills/ for Claude Code access - Update BMad core to v6.2.2 (restructured _bmad/ directory layout) - AgentShield security scan: Grade A (100/100) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#15) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#22) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#18) - Scope workflow token permissions to read-all with per-job overrides (#19) - Pin all GitHub Action dependencies to commit SHAs (#20) - Ensure SAST (CodeQL) runs on all push commits to main (#21) Closes #18, #19, #20, #21 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.1 (#27) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#24) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#28) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#30) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#26) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#34) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bee87b3...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#48) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#49) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#61) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#62) * chore: add CODEOWNERS file for code review enforcement Adds .github/CODEOWNERS assigning @don-petry as default code owner for all files, satisfying the compliance requirement for code owner review enforcement on pull requests. Closes #47 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * fix: rename codeql workflow and add javascript-typescript + actions matrix (#81) - Rename codeql-analysis.yml → codeql.yml (compliance: exact filename required) - Replace Python with javascript-typescript (matches TalkTerm stack) - Add actions language scan (required: repo has .github/workflows/*.yml) - Use matrix strategy for multi-language scanning per ci-standards.md - Update schedule to Friday 17:00 UTC per org standard Closes #41 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#82) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: correct reusable workflow path (remove duplicate .github/) (#135) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#135)" This reverts commit 2f121a1. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(ci): remove stray codeql.yml workflow (#115) The org now uses GitHub-managed CodeQL default setup. The per-repo codeql.yml was drift and ran a duplicate analysis alongside default setup. Removing it per the org standard. Closes #96 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(security): remove drift codeql.yml, enable GitHub-managed default setup (#117) Per org CI standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. Per-repo codeql.yml files are treated as drift by the compliance audit. Actions taken: - Removed .github/workflows/codeql.yml (drift per-repo advanced setup) - Re-confirmed default setup via API: state=configured, query_suite=default The GitHub-managed default setup is already running CodeQL scans. The compliance audit 403 is a PAT scope issue in the audit bot (needs Administration:read scope on the audit bot token in petry-projects/.github). Closes #95 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix(ci): pin agent-shield reusable workflow to SHA (#126) Pins agent-shield-reusable.yml@v1 to its full commit SHA (ee22b427cbce9ecadcf2b436acb57c3adf0cb63d) to satisfy the org-wide action-pinning policy. Closes #85 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore: add bot accounts to CODEOWNERS for auto-merge support * chore: standardize CODEOWNERS on @petry-projects/org-leads (#160) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#176) * feat: implement issue #162 — Compliance: codeowners-no-catchall (#182) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #175 — Compliance: non-stub-pr-review-mention.yml (#185) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #161 — Compliance: codeowners-org-leads-not-first (#189) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #200 — [Fleet Monitor] petry-projects/TalkTerm — dev-lead.yml (#202) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #86 — Compliance: unpinned-actions-claude.yml (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #163 — Compliance: check-suite-auto-trigger-1236702 (#206) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#236) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #272 — Compliance: dev-lead-stub-pin (#297) * feat: implement issue #272 — Compliance: dev-lead-stub-pin * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #217 — Compliance: codeowners-org-leads-not-first (#270) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci(dev-lead): pin caller to @dev-lead/ring1 (staged canary) (#306) * ci(dev-lead): pin caller to @dev-lead/ring1 (staged canary ring) * fix(security): suppress gitleaks false positives for commit c5099d1 Adds .gitleaksignore fingerprints for commit c5099d1 which contains the same SHA256 content checksums in _bmad/_config/files-manifest.csv that have been documented as false positives in five prior commits. The generic-api-key rule flags high-entropy hex strings; these are file-content checksums, not credentials. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #227 — Compliance: check-suite-auto-trigger-347564 Pin org reusable workflows to @v1 (agent-shield, dependabot-automerge, dependency-audit) and reinforce repo settings via a weekly schedule plus self-path trigger and a concurrency group on apply-repo-settings. Closes #227 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(secret-scan): suppress gitleaks false positives in commit 38e9f74 Added suppression for commit 38e9f74 which contains the same _bmad/_config/files-manifest.csv CSV rows (SHA256 checksums of BMAD skill files, not API keys) as previously-reviewed commits. Gitleaks generic-api-key rule flags high-entropy hex strings; these are file-content checksums, not credentials. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(secret-scan): suppress additional gitleaks false positive in da36d9b Commit da36d9b contains the same false-positive generic-api-key findings in _bmad/_config/files-manifest.csv (lines 281, 282, 284, 300, 409, 433) as earlier commits. These are SHA256 file-content checksums in a manifest CSV, not API keys. Adding them to .gitleaksignore to resolve the full-history gitleaks enforcement check failure. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(bot): address bot feedback [skip ci-relay] * fix(secret-scan): suppress remaining gitleaks false positives Gitleaks full-history enforcement (CLI scan) found 11 unflagged fingerprints in two commits: - f57f035: rebase/merge copy of "chore: add ECC integration, TEA module, and slim CLAUDE.md" — all 6 lines (281, 282, 284, 300, 409, 433) in _bmad/_config/files-manifest.csv were unregistered. - 3d0fa15: same commit message variant — lines 281, 282, 284, 300, 409 were missing; only line 433 had been suppressed. All findings are SHA256 content checksums in the BMAD files-manifest CSV, not real credentials. Same false-positive rationale as the previously suppressed entries above them in .gitleaksignore. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Root <donpetry@users.noreply.github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #227
Implemented by dev-lead agent. Please review.