Repo configuration note

[twhetzel]

When using AI with your ontology, confirm that these repo configurations are in place:

• the main (or master) branch is protected
• set-up rules for this protected branch to require a PR before merging
• require at least one PR reviewer to approve the PR
• do not allow bypassing the above settings

These checkboxes can be found under Settings -> Branches -> Branch protection rules for the protected branch.

[github-actions]

Repository Security Configuration for AI-Assisted Ontology Curation

Issue Summary

This issue provides critical security guidelines for repositories using AI agents in ontology curation workflows. The recommendations address fundamental version control security practices that become especially important when AI systems have write access to repositories.

Research Context & Academic Foundation

Recent research highlights significant risks in AI-assisted software development:

• Security vulnerabilities: 42% of AI-generated code snippets contain security flaws (arXiv research)
• Data leakage: 10% of prompts may leak private information
• Consensus bias: AI models can "agree" with incorrect ideas, amplifying mistakes
• Irreversible actions: AI agents can perform destructive operations without proper oversight

Core Security Recommendations

The issue correctly identifies essential branch protection requirements:

🔒 Branch Protection Rules

• ✅ Protect main (or master) branch
• ✅ Require pull requests before merging
• ✅ Require at least one PR reviewer approval
• ✅ Prevent bypassing protection settings (critical for AI safety)

📍 Configuration Location

Settings → Branches → Branch protection rules for protected branch

Integration with Existing Repository Challenges

This security configuration directly addresses several ongoing issues in the aidocs repository:

Issue #39: Claude Code Permissions

• Recent permission changes have left many AI agents non-functional
• Proper branch protection provides a safety net even when agent permissions are misconfigured
• Creates accountability through required human review

Issue #40: Ontology Pipeline Unification

• Multiple ontology repositories (Mondo, CL, EFO, Uberon, NAMO) need consistent security standards
• Branch protection should be standardized across all AI-assisted ontology workflows
• Prevents "PR rejection cycles for trivial metadata issues" by ensuring quality gates

Issue #37: Anti-Hallucination Validation (Completed)

• Branch protection complements the ID/label checksum pattern
• Human reviewers can catch hallucinated identifiers that pass validation
• Provides multiple layers of safety against AI-generated errors

Extended Security Framework

Beyond the basic requirements, consider implementing:

Advanced Protection Features

• Signed commits: Verify commit authenticity
• Status checks: Require automated tests to pass
• Linear history: Prevent complex merge conflicts
• Conversation resolution: Ensure all PR discussions are addressed

AI-Specific Safeguards

• Review assignment: Assign domain experts as required reviewers for ontology changes
• Automated validation hooks: Integration with tools like ODK for ontology-specific validation
• Change magnitude limits: Consider restrictions on large-scale automated changes

Implementation Strategy

Immediate Actions

1. Audit all AI-enabled repositories for branch protection status
2. Implement the four core requirements listed in this issue
3. Document protection settings in repository CLAUDE.md files

Repository-Specific Considerations

• Ontology repositories: May need specialized reviewers with domain expertise
• Documentation repositories: Can use lighter-weight review processes
• Infrastructure repositories: May require additional security measures

Relationship to Broader AI4Curation Goals

This security framework aligns with the repository's mission to provide "practical, immediately actionable" guidance for AI integration:

• Immediate value: Prevents potentially destructive AI actions
• Scalable solution: Applies across all GitHub-based ontology workflows
• Integration-friendly: Works with existing Claude Code, Copilot, and custom agent setups
• Community-tested: Builds on established GitHub security best practices

Documentation Opportunities

Consider creating:

• docs/how-tos/secure-ai-repository-setup.md: Step-by-step implementation guide
• docs/reference/security-checklist.md: Audit checklist for existing repositories
• Integration into existing GitHub Actions setup documentation

Next Steps

1. Validate current repository: Verify this repository follows its own security recommendations
2. Template creation: Develop standard branch protection templates for different repository types
3. Community rollout: Coordinate implementation across ontology repositories mentioned in Issue Unify all the different ontology pipelines #40
4. Monitoring setup: Consider automated monitoring of protection settings across repositories

---

Priority: HIGH - This represents foundational security for AI-assisted curation workflows

Related Issues: #39 (permissions), #40 (standardization), #37 (validation), #15 (integration options)