Compliance: stub-surface-drift-pr-auto-review.yml-on

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: stub-surface-drift-pr-auto-review.yml-on

Detail

The pr-auto-review.yml caller stub's on: surface has drifted from the canonical standards/workflows/pr-auto-review.yml. These stubs are thin callers — the on: triggers, permissions: grants, and concurrency: block are owned centrally and are not repo-adjustable (only the documented with: inputs and the tier channel pin may differ per repo). Re-sync on: from standards/workflows/pr-auto-review.yml.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #331 — Compliance: stub-surface-drift-pr-auto-review.yml-on

Scope

Re-sync the on: trigger surface of .github/workflows/pr-auto-review.yml to match the canonical standards/workflows/pr-auto-review.yml, clearing the stub-surface-drift-pr-auto-review.yml-on finding.

Root cause

The audit's stub_surface_drift helper extracts the on: block, strips comments/blank lines (stub_normalize_surface), and does a verbatim string compare against the canonical template. The workflow_run.workflows list is not exempted from that comparison (only schedule cron values are). The deployed stub reads:

workflows: ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"]

while the canonical reads workflows: ["CI"]. That single line is the entire drift. (CodeQL is also stale — this repo has no workflow named CodeQL.) The permissions: and concurrency: surfaces already match, which is why only the -on finding fired.

Implementation Checklist

• .github/workflows/pr-auto-review.yml — set workflow_run.workflows to ["CI"] to match canonical; leave all other lines (permissions, uses: channel pin @pr-auto-review/stable, if: guard, secrets) unchanged.

Tests to Write

• No repo unit tests apply. Verification is done by running the org audit's own stub_surface_drift helper (from petry-projects/.github scripts/compliance-audit.sh) against the canonical template and the edited stub, asserting no drift on the on, permissions, and concurrency surfaces. This mirrors the stub-surface-drift.bats guard and is a config re-sync with no repo-code behavior to unit-test.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh (repo lint) + org audit helper drift check (see report).

Note / follow-up

The template header still advertises workflow_run.workflows as repo-adjustable, which contradicts the surface-drift guard that compares it verbatim. Syncing to ["CI"] clears the finding; a follow-up against petry-projects/.github may be warranted to reconcile that contradiction. Implemented per the issue's explicit instruction to re-sync on: from canonical.

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Fetched canonical standards/workflows/pr-auto-review.yml from petry-projects/.github (blocked ~19 min on a shared GitHub API rate-limit exhaustion; waited for reset, then fetched).
• Confirmed the exact drift via the org audit's own helpers (stub_extract_blocks / stub_normalize_surface / stub_surface_drift in scripts/compliance-audit.sh) and the stub-surface-drift.bats guard.
• Re-synced the on: surface: workflow_run.workflows ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"] → ["CI"] to match canonical.
• Verified no drift on all three guarded surfaces (on, permissions, concurrency).
• Ran repo lint (.dev-lead/scripts/dev-lead-lint.sh) — passed. Validated workflow YAML parses.

Root Cause

The audit's stub_surface_drift extracts the on: block, strips comments/blank lines, and does a verbatim string compare against the canonical template. Only schedule cron values are normalized out — the workflow_run.workflows list is not exempted. The deployed stub listed four workflows vs. canonical's ["CI"], so that one line was the entire -on drift. (CodeQL was also stale — no workflow by that name exists in this repo.) The permissions: and concurrency: surfaces already matched, which is why only the -on finding fired.

Test Results

Ran the org audit's actual drift helpers (extracted verbatim from scripts/compliance-audit.sh) against the fetched canonical and the edited stub:

# Pre-edit (red):
PRE-EDIT: on surface DRIFTS (expected red)

# Post-edit (green):
CLEAN   surface: on
CLEAN   surface: permissions
CLEAN   surface: concurrency
overall_rc=0

# Repo lint:
  [lint] shellcheck: no .sh files found — skipping
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

# YAML parse:
parsed OK; on keys: ['workflow_run', 'check_suite', 'pull_request_review', 'pull_request']
workflow_run.workflows: ['CI']

Files Changed

• .github/workflows/pr-auto-review.yml: set workflow_run.workflows to ["CI"] (one-line change). permissions:, the fork/Dependabot if: guard, the @pr-auto-review/stable channel pin, and secrets: are unchanged.

Notes

• Behavior-preserving config re-sync, so per the Phase 2 exception no repo unit tests were added; verification uses the org audit's own drift helpers (red→green shown above), which is the exact logic that gates this finding.
• Tradeoff / follow-up: the template header still advertises workflow_run.workflows as repo-adjustable, which contradicts the surface-drift guard that compares it verbatim. Reducing to ["CI"] means the auto-review no longer re-triggers via workflow_run when SonarCloud Analysis / Dev-Lead Agent complete — but the reusable re-computes readiness on every trigger (incl. check_suite, pull_request, pull_request_review), so current check states are still honored. This matches the central design. A follow-up PR against petry-projects/.github may be warranted to reconcile that header-vs-guard contradiction.
• Did not commit/push/open a PR — per instructions the CI workflow handles git operations.

[don-petry]

Dev-Lead Implementation Plan

Issue: #331 — Compliance: stub-surface-drift-pr-auto-review.yml-on

Scope

Re-sync the on: surface of the .github/workflows/pr-auto-review.yml caller stub to match the canonical standards/workflows/pr-auto-review.yml. The only drift is in on.workflow_run.workflows.

Root Cause

The stub's on.workflow_run.workflows is ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"], but the centrally-owned canonical surface is ["CI"]. All other on: triggers (check_suite, pull_request_review, pull_request) already match. Per the centralization-tier standard, the on: surface is not repo-adjustable.

Implementation Checklist

• .github/workflows/pr-auto-review.yml — set on.workflow_run.workflows to ["CI"] to match canonical

Tests to Write

• N/A — this is a CI-workflow config change with no application-level behavior. Verification is via YAML validity + the repo lint script (Phase-2 TDD exception for config/behavior-preserving change).

Test Command

bash ".dev-lead/scripts/dev-lead-lint.sh" (plus YAML parse validation)

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Identified the sole on: drift: on.workflow_run.workflows was ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"] vs canonical ["CI"]
• Re-synced on.workflow_run.workflows to ["CI"] to match standards/workflows/pr-auto-review.yml
• Confirmed all other on: triggers (check_suite, pull_request_review, pull_request) already matched canonical — no changes needed
• Validated YAML parses cleanly
• Ran repo lint (.dev-lead/scripts/dev-lead-lint.sh) — passed

Test Results

No application-level tests apply (CI-workflow config change; Phase-2 TDD exception for a behavior-preserving config re-sync). Verification output:

$ python3 -c "import yaml; yaml.safe_load(open('.github/workflows/pr-auto-review.yml'))"
YAML OK

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck: no .sh files found — skipping
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

Files Changed

• .github/workflows/pr-auto-review.yml: set on.workflow_run.workflows from ["CI", "SonarCloud Analysis", "Dev-Lead Agent", "CodeQL"] to ["CI"], matching the centrally-owned canonical on: surface. The structural on: surface is now identical to standards/workflows/pr-auto-review.yml.

Notes

• Scope: Only the on: surface was changed, per check stub-surface-drift-pr-auto-review.yml-on. The header comment block, permissions:, jobs:, uses: channel pin, and secrets: block were left untouched as they are outside this finding's scope.
• Behavioral consideration: Auto-review re-evaluation via workflow_run now keys only on the CI workflow completing (was also keying on SonarCloud Analysis, Dev-Lead Agent, and a non-existent CodeQL workflow). This aligns with the canonical design where check_suite covers third-party CI (e.g. SonarCloud) and the on: surface is centrally owned/non-repo-adjustable per the centralization-tier standard.
• Stale comment (not modified — out of scope): The header still reads "You MAY change ... the workflow name(s) in workflow_run.workflows", which contradicts the current centralization-tier rule that the on: surface is not repo-adjustable. This template comment appears out of date vs. the canonical guidance ("You MUST NOT change ... trigger event types"). Recommend the org update the stub template comment to prevent re-drift — best raised as a follow-up against the central petry-projects/.github template rather than edited here.