Compliance audit — 2026-05-08

[don-petry]

Compliance Audit — 2026-05-08

This umbrella issue tracks all findings from the automated compliance audit run on 2026-05-08.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 136 across 8 repositories

---

Remediation Work Breakdown

Repository Settings (47 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	allow_auto_merge	warning
.github	delete_branch_on_merge	warning
.github	codeowners-org-leads-not-first	error
.github	codeowners-no-catchall	warning
.github	check-suite-auto-trigger-1236702	error
.github	check-suite-auto-trigger-347564	error
TalkTerm	allow_auto_merge	warning
TalkTerm	delete_branch_on_merge	warning
TalkTerm	codeowners-org-leads-not-first	error
TalkTerm	codeowners-no-catchall	warning
TalkTerm	check-suite-auto-trigger-1236702	error
TalkTerm	check-suite-auto-trigger-347564	error
.github-private	allow_auto_merge	warning
.github-private	delete_branch_on_merge	warning
.github-private	has_discussions	error
.github-private	codeowners-org-leads-not-first	error
.github-private	codeowners-no-catchall	warning
.github-private	check-suite-auto-trigger-1236702	error
.github-private	check-suite-auto-trigger-347564	error
markets	allow_auto_merge	warning
markets	delete_branch_on_merge	warning
markets	codeowners-org-leads-not-first	error
markets	codeowners-no-catchall	warning
markets	check-suite-auto-trigger-1236702	error
markets	check-suite-auto-trigger-347564	error
ContentTwin	allow_auto_merge	warning
ContentTwin	delete_branch_on_merge	warning
ContentTwin	codeowners-org-leads-not-first	error
ContentTwin	codeowners-no-catchall	warning
ContentTwin	check-suite-auto-trigger-1236702	error
ContentTwin	check-suite-auto-trigger-347564	error
broodly	allow_auto_merge	warning
broodly	delete_branch_on_merge	warning
broodly	codeowners-org-leads-not-first	error
broodly	codeowners-no-catchall	warning
broodly	check-suite-auto-trigger-1236702	error
broodly	check-suite-auto-trigger-347564	error
google-app-scripts	allow_auto_merge	warning
google-app-scripts	delete_branch_on_merge	warning
google-app-scripts	codeowners-org-leads-not-first	error
google-app-scripts	codeowners-no-catchall	warning
google-app-scripts	check-suite-auto-trigger-1236702	error
google-app-scripts	check-suite-auto-trigger-347564	error
bmad-bgreat-suite	allow_auto_merge	warning
bmad-bgreat-suite	delete_branch_on_merge	warning
bmad-bgreat-suite	check-suite-auto-trigger-1236702	error
bmad-bgreat-suite	check-suite-auto-trigger-347564	error

Push Protection & Secret Scanning (17 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	security_and_analysis_unavailable	warning
.github	secret_scan_ci_job_present	error
TalkTerm	security_and_analysis_unavailable	warning
.github-private	security_and_analysis_unavailable	warning
.github-private	gitignore_secrets_block	warning
markets	security_and_analysis_unavailable	warning
markets	secret_scan_ci_job_present	error
ContentTwin	security_and_analysis_unavailable	warning
ContentTwin	secret_scan_ci_job_present	error
broodly	security_and_analysis_unavailable	warning
broodly	secret_scan_ci_job_present	error
broodly	gitignore_secrets_block	warning
google-app-scripts	security_and_analysis_unavailable	warning
google-app-scripts	gitignore_secrets_block	warning
bmad-bgreat-suite	security_and_analysis_unavailable	warning
bmad-bgreat-suite	secret_scan_ci_job_present	error
bmad-bgreat-suite	gitignore_secrets_block	warning

Repository Rulesets (2 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github-private

Repo	Check	Severity
.github-private	missing-pr-quality	error
.github-private	missing-code-quality	error

Workflows (29 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	codeql-default-setup-not-configured	error
TalkTerm	codeql-default-setup-not-configured	error
TalkTerm	non-stub-dependency-audit.yml	error
TalkTerm	non-stub-dependabot-automerge.yml	error
TalkTerm	non-stub-agent-shield.yml	error
TalkTerm	non-stub-feature-ideation.yml	error
.github-private	missing-ci.yml	error
.github-private	missing-sonarcloud.yml	error
.github-private	missing-dependabot-automerge.yml	error
.github-private	missing-dependency-audit.yml	error
.github-private	missing-agent-shield.yml	error
.github-private	codeql-default-setup-not-configured	error
.github-private	claude-missing-check-run-trigger	warning
.github-private	non-stub-claude.yml	error
markets	codeql-default-setup-not-configured	error
markets	stray-codeql-workflow	error
markets	non-stub-dependabot-rebase.yml	error
ContentTwin	codeql-default-setup-not-configured	error
ContentTwin	stray-codeql-workflow	error
ContentTwin	non-stub-dependabot-rebase.yml	error
broodly	codeql-default-setup-not-configured	error
broodly	stray-codeql-workflow	error
broodly	non-stub-dependabot-rebase.yml	error
google-app-scripts	codeql-default-setup-not-configured	error
google-app-scripts	stray-codeql-workflow	error
google-app-scripts	non-stub-dependabot-rebase.yml	error
bmad-bgreat-suite	codeql-default-setup-not-configured	error
bmad-bgreat-suite	stray-codeql-workflow	error
bmad-bgreat-suite	non-stub-auto-rebase.yml	error

Action SHA Pinning (35 finding(s))

Remediation: pin actions to SHA in each workflow file
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	unpinned-actions-agent-shield.yml	error
.github	unpinned-actions-claude.yml	error
.github	unpinned-actions-dependency-audit.yml	error
TalkTerm	unpinned-actions-auto-rebase.yml	error
TalkTerm	unpinned-actions-claude.yml	error
TalkTerm	unpinned-actions-dependabot-rebase.yml	error
.github-private	unpinned-actions-pr-review.yml	error
.github-private	unpinned-actions-repair-pr-approvals.yml	error
markets	unpinned-actions-agent-shield.yml	error
markets	unpinned-actions-auto-rebase.yml	error
markets	unpinned-actions-claude.yml	error
markets	unpinned-actions-dependabot-automerge.yml	error
markets	unpinned-actions-dependency-audit.yml	error
markets	unpinned-actions-feature-ideation.yml	error
ContentTwin	unpinned-actions-agent-shield.yml	error
ContentTwin	unpinned-actions-auto-rebase.yml	error
ContentTwin	unpinned-actions-claude.yml	error
ContentTwin	unpinned-actions-dependabot-automerge.yml	error
ContentTwin	unpinned-actions-dependency-audit.yml	error
broodly	unpinned-actions-agent-shield.yml	error
broodly	unpinned-actions-auto-rebase.yml	error
broodly	unpinned-actions-claude.yml	error
broodly	unpinned-actions-dependabot-automerge.yml	error
broodly	unpinned-actions-dependency-audit.yml	error
broodly	unpinned-actions-feature-ideation.yml	error
google-app-scripts	unpinned-actions-agent-shield.yml	error
google-app-scripts	unpinned-actions-auto-rebase.yml	error
google-app-scripts	unpinned-actions-claude.yml	error
google-app-scripts	unpinned-actions-dependabot-automerge.yml	error
google-app-scripts	unpinned-actions-dependency-audit.yml	error
google-app-scripts	unpinned-actions-feature-ideation.yml	error
bmad-bgreat-suite	unpinned-actions-agent-shield.yml	error
bmad-bgreat-suite	unpinned-actions-claude.yml	error
bmad-bgreat-suite	unpinned-actions-dependabot-automerge.yml	error
bmad-bgreat-suite	unpinned-actions-dependency-audit.yml	error

Dependabot Configuration (4 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: .github-private, google-app-scripts

Repo	Check	Severity
.github-private	missing-github-actions-ecosystem	error
.github-private	missing-security-label	warning
.github-private	missing-dependencies-label	warning
google-app-scripts	wrong-limit-npm	warning

CLAUDE.md / AGENTS.md References (2 finding(s))

Remediation: per-repo doc updates
Affected repos: .github-private

Repo	Check	Severity
.github-private	claude-md-missing-agents-ref	error
.github-private	agents-md-missing-org-ref	error

---

Generated by the weekly compliance audit on 2026-05-08 14:15 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

[don-petry]

Claude finished @don-petry's task in 9m 19s —— View job • claude/issue-215-20260508-1420 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-215-20260508-1420?quick_pull=1&title=Issue%20%23215%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23215%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Compliance Audit 2026-05-08 — .github Repo Fixes

Changes applied and PR created.

Findings status

Finding	Status	Notes
allow_auto_merge	✅ Already correct	true confirmed via API
delete_branch_on_merge	✅ Already correct	true confirmed via API
codeowners-org-leads-not-first	✅ False positive	* @petry-projects/org-leads already in place
codeowners-no-catchall	✅ False positive	* catch-all already present
codeql-default-setup-not-configured	✅ Already configured	state=configured confirmed via API
check-suite-auto-trigger-1236702	✅ Fixed via API	PATCH applied — setting: false for Claude (1236702)
check-suite-auto-trigger-347564	✅ Fixed via API	PATCH applied — setting: false for CodeRabbit (347564)
unpinned-actions-dependency-audit.yml	✅ Fixed in PR	dtolnay/rust-toolchain@stable pinned to SHA 29eef336
secret_scan_ci_job_present	✅ Fixed in PR	Added secret-scan gitleaks job to ci.yml
security_and_analysis_unavailable	⚠️ Skipped	Warning only; requires org-admin PAT to configure security_and_analysis settings
unpinned-actions-agent-shield.yml	ℹ️ False positive	Internal reusable ref (@v1) is exempt per Action Pinning Policy; file is immutable per workflow-exemptions.json
unpinned-actions-claude.yml	ℹ️ False positive	Internal reusable ref (@main) is exempt; file is immutable per OIDC constraint

• Read AGENTS.md and standards/ for context
• Audit current state: CODEOWNERS, workflow files, API settings
• Fix dependency-audit.yml — pin dtolnay/rust-toolchain@stable to SHA 29eef336
• Add secret-scan gitleaks job to ci.yml
• Fix check-suite auto-trigger preferences via API (no PR needed)
• Commit and push changes
• Create PR

Create a PR — already created at #216

@petry-projects/org-leads — PR #216 is ready for review and merge.
|

[don-petry]

Resolved! This check is now passing as of 2026-05-11. Closing automatically.