Compliance audit — 2026-07-17

[don-petry]

Compliance Audit — 2026-07-17

This umbrella issue tracks all findings from the automated compliance audit run on 2026-07-17.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 55 across 11 repositories

---

Remediation Work Breakdown

Repository Settings (2 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: incubator

Repo	Check	Severity
incubator	delete_branch_on_merge	warning
incubator	has_wiki	warning

Push Protection & Secret Scanning (2 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: broodminder-export, repo-template

Repo	Check	Severity
broodminder-export	gitignore_secrets_block	warning
repo-template	gitignore_secrets_block	warning

Repository Rulesets (17 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, incubator, markets, repo-template

Repo	Check	Severity
.github	ruleset-drift-pr-quality-allowed_merge_methods	error
.github	ruleset-drift-code-quality-required_status_checks	error
bmad-bgreat-suite	ruleset-drift-code-quality-required_status_checks	error
broodly	ruleset-drift-pr-quality-require_code_owner_review	error
broodly	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
broodly	ruleset-drift-pr-quality-require_last_push_approval	error
ContentTwin	ruleset-drift-pr-quality-require_code_owner_review	error
ContentTwin	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
ContentTwin	ruleset-drift-pr-quality-require_last_push_approval	error
incubator	legacy-ruleset-incubation-gate	error
markets	ruleset-drift-pr-quality-require_code_owner_review	error
markets	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
markets	ruleset-drift-pr-quality-require_last_push_approval	error
markets	ruleset-drift-code-quality-required_status_checks	error
TalkTerm	ruleset-drift-pr-quality-allowed_merge_methods	error
repo-template	missing-code-quality	error
repo-template	ruleset-drift-pr-quality-allowed_merge_methods	error

Workflows (33 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, broodminder-export, google-app-scripts, incubator, markets

Repo	Check	Severity
.github-private	missing-permissions-dismiss-stale-bot-reviews.yml	warning
bmad-bgreat-suite	dev-lead-stub-pin	error
bmad-bgreat-suite	dev-lead-stub-agent-ref	error
bmad-bgreat-suite	stub-surface-drift-feature-ideation.yml-permissions	error
broodminder-export	dev-lead-stub-pin	error
broodminder-export	dev-lead-stub-agent-ref	error
broodly	dev-lead-stub-pin	error
broodly	dev-lead-stub-agent-ref	error
ContentTwin	dev-lead-stub-pin	error
ContentTwin	dev-lead-stub-agent-ref	error
ContentTwin	stub-surface-drift-dependency-audit.yml-concurrency	warning
ContentTwin	stub-surface-drift-pr-review-mention.yml-concurrency	warning
ContentTwin	stub-surface-drift-feature-ideation.yml-on	error
ContentTwin	stub-surface-drift-feature-ideation.yml-permissions	error
ContentTwin	stub-surface-drift-pr-auto-review.yml-on	error
ContentTwin	stub-surface-drift-pr-auto-review.yml-concurrency	warning
incubator	dev-lead-stub-pin	error
incubator	dev-lead-stub-agent-ref	error
markets	non-stub-feature-ideation.yml	error
markets	dev-lead-stub-pin	error
markets	dev-lead-stub-agent-ref	error
markets	stub-surface-drift-feature-ideation.yml-on	error
markets	stub-surface-drift-feature-ideation.yml-permissions	error
markets	stub-surface-drift-pr-auto-review.yml-on	error
TalkTerm	dev-lead-stub-pin	error
TalkTerm	dev-lead-stub-agent-ref	error
TalkTerm	stub-surface-drift-feature-ideation.yml-permissions	error
TalkTerm	stub-surface-drift-pr-auto-review.yml-permissions	error
google-app-scripts	dev-lead-stub-pin	error
google-app-scripts	dev-lead-stub-agent-ref	error
google-app-scripts	stub-surface-drift-feature-ideation.yml-on	error
google-app-scripts	stub-surface-drift-feature-ideation.yml-permissions	error
google-app-scripts	stub-surface-drift-pr-auto-review.yml-on	error

Reusable Workflows (disabled_manually) (1 finding(s))

Remediation: gh workflow disable <workflow> -R <repo>
Affected repos: .github

Repo	Check	Severity
.github	reusable-not-disabled-manually-persona-mention-reusable.yml	warning

---

Generated by the weekly compliance audit on 2026-07-17 13:55 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

[don-petry]

Resolved! This check is now passing as of 2026-07-24. Closing automatically.