feat: implement issue #772 — Compliance: ruleset-drift-code-quality-required_status_checks - #775
feat: implement issue #772 — Compliance: ruleset-drift-code-quality-required_status_checks#775don-petry wants to merge 70 commits into
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reached
Next review available in: 8 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds BATS tests to verify that the dependency-audit.yml workflow is configured as a caller stub using the reusable workflow and does not contain an inline detect job. The review feedback highlights two key issues: the specified workflow file path does not exist in the repository, which will cause the tests to fail, and using a non-zero exit status check for grep can lead to false positives on error, so asserting an exit status of exactly 1 is recommended.
| # pattern. The pre-centralization inline workflow ran a top-level `detect` job | ||
| # directly, publishing the bare `Detect ecosystems` context and drifting the | ||
| # live ruleset off the codified name (#772). | ||
| DEP_AUDIT_WF="$SCRIPT_DIR/.github/workflows/dependency-audit.yml" |
There was a problem hiding this comment.
The path is set to $SCRIPT_DIR/.github/workflows/dependency-audit.yml. However, this file does not exist in the repository (only standards/workflows/dependency-audit.yml is present).
If the intention is to test the standard template workflow, the path should be updated to standards/workflows/dependency-audit.yml. If the intention is to test the self-hosted workflow, please make sure that .github/workflows/dependency-audit.yml is added to the repository/PR, otherwise the tests will fail.
There was a problem hiding this comment.
There was a problem hiding this comment.
Confirmed: .github/workflows/dependency-audit.yml exists in the repo (added in commit 1895c1c as part of issue #772). SCRIPT_DIR resolves three levels up from the test file to the repo root, so the path $SCRIPT_DIR/.github/workflows/dependency-audit.yml is correct — no change needed here. Leaving thread open per bot-thread policy.
There was a problem hiding this comment.
Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.
Note
This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
* Add multi-agent isolation strategy using git worktrees Define org-wide rules for running multiple AI agents concurrently without conflicts: one worktree per agent, no overlapping file ownership, tool-specific setup for Claude Code/Copilot/Codex/Cursor, naming conventions, cleanup, and a pre-launch coordination checklist. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Address review comments: overlap detection, markdown fixes, branch clarity - Add "Detecting File Overlap" subsection per CodeRabbit suggestion - Reword origin/HEAD to reference default branch explicitly (Copilot) - Qualify "name flows into branch" for manual worktrees (Copilot) - Quote isolation: "worktree" consistently in YAML example (Copilot) - Add git branch -D fallback for squash/rebase merges (Copilot) - Fix markdown blank lines and language specifiers (CodeRabbit) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add weekly compliance audit workflow Adds automated weekly audit that checks all petry-projects repos against org standards (CI, Dependabot, settings, labels, rulesets) and creates/updates/closes issues for each finding. - Deterministic shell script for reliable, repeatable checks - Claude Code Action job for standards improvement research - Issues auto-assigned to Claude for remediation - Summary notification for org owners - Idempotent: updates existing issues, closes resolved ones Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review findings in compliance audit - Add retry error logging to gh_api helper - Fix pnpm detection when package.json absent - Fix empty ecosystem array display - Replace heredoc with direct assignment for issue body - Add jq error safety in close_resolved_issues - Increase repo list limit to 500 with empty check - Use process substitution instead of pipe subshell - Add concurrency group and timeout to workflow - Add timeout-minutes to audit job Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address CodeRabbit and Copilot review comments - Handle single-job workflows with job-level permissions - Add has_issues to required settings checks - Soften CODEOWNERS wording (SHOULD not MUST per standards) - Remove misleading issues:write from audit job permissions - Rename repo_count to repos_with_findings for clarity Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: do not auto-close previous summary issues Per feedback, only humans should close summary/notification issues. Changed Claude prompt to explicitly not close them. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add full CI pipeline for .github repo Adds all 6 required workflows per ci-standards.md: - ci.yml: markdownlint, yamllint, actionlint, shellcheck, AgentShield - codeql.yml: actions language analysis - sonarcloud.yml: code quality scanning - claude.yml: AI-assisted PR review - dependabot-automerge.yml: auto-merge eligible PRs - dependency-audit.yml: vulnerability scanning Also adds: - .github/dependabot.yml (github-actions ecosystem) - .markdownlint-cli2.yaml (config for standards docs) - sonar-project.properties Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: correct markdownlint SHA, use npx for AgentShield, remove duplicate CodeQL - Fix markdownlint-cli2-action SHA to v9.0.0 (v20 doesn't exist) - Use npx ecc-agentshield CLI instead of broken GitHub Action - Remove codeql.yml — repo already has default CodeQL setup enabled Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: relax markdownlint rules, pin actionlint download - Disable line-length, duplicate-heading, blanks-around-lists, bare-urls rules — existing docs have many violations; fix incrementally as separate PRs - Replace curl|bash with pinned version download for actionlint (fixes SonarCloud security hotspot) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: break long line in org-scorecard.yml for yamllint Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: make actionlint fail on errors, guard shellcheck glob - Remove || true from actionlint on our own workflows (fail properly) - Keep || true only for template workflows (expected placeholder issues) - Guard shellcheck glob against missing scripts/ directory Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: ignore shellcheck style hints in actionlint SC2129 (use grouped redirects) is a style suggestion, not a bug. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add SHA256 checksum verification for curl downloads Addresses SonarCloud security hotspots by verifying checksums on all binary downloads: - actionlint 1.7.7 in ci.yml - scorecard 5.1.1 in org-scorecard.yml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enforce MD041, add standards references to all YAML files - Enable MD041 (first line heading) — all markdown files already comply - Add header comment to each workflow YAML with purpose and link to the org standard definition that governs it - Add header comment to dependabot.yml Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Replaces compliance-audit.yml with compliance-audit-and-improvement.yml,
extending the existing weekly compliance audit with runtime health
telemetry and a forward-looking best practices research phase.
Architecture (3 jobs):
Job 1 — Compliance Audit (unchanged)
Deterministic shell script checking all repos against org standards.
Creates/updates/closes compliance issues per finding.
Job 2 — Health Survey (new)
Collects runtime telemetry across all org repos:
CI run failures (7d), security alerts (Dependabot/secret/code scanning),
PR staleness, branch protection status, workflow inventory.
Job 3 — Analyze & Create Issues (Claude, rewritten)
Six-phase analysis combining both datasets:
1. Load compliance + health data and org standards
2. Correlate and categorize findings by severity
3. Research root causes and automation opportunities
4. Evaluate against industry best practices and emerging capabilities
(agentic guardrails, supply chain integrity, reliability SLOs, etc.)
— outputs only standards proposals, not implementation issues
5. Create issues: repo-specific go in that repo, org-wide in .github,
every issue gets the claude label for agent pickup
6. Summary report to step summary
Issue rules:
- Every issue must have the `claude` label
- Repo-specific issues are created in that repo
- Org-wide and standards proposals go in .github
- Deduplicates against existing open issues
- Max 3 standards-improvement + 3 best-practices proposals per run
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…#22) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.89. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@v1.0.83...6e2bd52) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.89 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…54) * feat: split Claude workflow into interactive + issue automation jobs The single-job Claude workflow created branches for issue-labeled triggers but never opened PRs — requiring a human to click through. Split into two jobs so issue-triggered work runs in automation mode with a prompt that drives the full lifecycle: implement, create PR, self-review, resolve comments, check CI, and tag the maintainer. Updates both the workflow and the ci-standards.md standard definition. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CODEOWNERS for maintainer tagging instead of hardcoded username The claude-issue prompt now reads CODEOWNERS at runtime to determine who to tag when a PR is ready. This removes the need for per-repo customization of the prompt. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
b38f61b to
1895c1c
Compare
🤖 CodeAnt AI — Review Status
|
Dev-Lead — rebase (applied)Rebase completed and pushed. |
codeant-ai
Bot
added
the
size:XL
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
Dev-Lead — fix-bot-comment (applied)Changes committed and pushed. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #775 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Dev-Lead — review-changes (applied)Changes committed and pushed. |
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #775 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
Review — fix requested (cycle 1/3)The automated review identified the following issues. Please address each one: Findings to fixAutomated review — NEEDS HUMAN REVIEWRisk: MEDIUM SummaryPR #775 correctly remediates compliance issue #772: .github/workflows/dependency-audit.yml is converted to a thin caller stub (job id 'dependency-audit' -> dependency-audit-reusable.yml), so the workflow now publishes the codified required status check 'dependency-audit / Detect ecosystems' — confirmed green on the head SHA. It also dedupes ensure_required_labels() in scripts/compliance-audit.sh (the surviving definition is the complete one incl. the 'in-progress' label), registers 5 reusables in standards/canary-rings.json, adds ci-standards.md guidance, and adds bats regression guards. The code is sound, but auto-approval is blocked by an unresolved review thread and two cancelled (superseded) dev-lead orchestration check runs. Linked issue analysisIssue #772 (ruleset-drift-code-quality-required_status_checks) required the repo to publish the context 'dependency-audit / Detect ecosystems' as codified in standards/rulesets/code-quality.json. The thin caller stub achieves exactly this (caller job id 'dependency-audit' + reusable job displayName 'Detect ecosystems'), and the check is SUCCESS on head SHA 793cd43. New bats tests lock the stub shape and forbid an inline 'detect' job. Substantively addressed. Findings
CI statusAll validation checks green on 793cd43: ShellCheck, Lint, bats, CodeQL, Analyze (actions), SonarCloud (quality gate passed), agent-shield / AgentShield, Agent Security Scan, Secret scan (gitleaks), dependency-audit / Detect ecosystems + npm audit (other ecosystems skipped, as expected). CANCELLED: 'dev-lead / dispatch' and 'dev-lead / ci-relay' (superseded dev-lead agent orchestration runs). Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review. Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
User description
Closes #772
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Align dependency auditing and compliance standards with centralized workflows
What Changed
dependency-audit / Detect ecosystemsstatus check.Impact
✅ Stable required dependency-audit checks✅ Centralized security-audit behavior across repositories✅ Safer BMAD idea backfills without duplicate comments💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.