[Fleet Monitor] petry-projects/.github-private — .github/workflows/ci.yml

[don-petry]

🟠 DEGRADED: petry-projects/.github-private / .github/workflows/ci.yml

Metric	Value
Failure Rate	27.6% (51 / 185 runs)
Status	DEGRADED
p50 Duration	160s
p95 Duration	354s
Successful Runs	133
Cancelled Runs	1

Workflow: .github/workflows/ci.yml

Last updated by Fleet Monitor run on 2026-06-14.
Threshold: failure rate > 10% over the monitored window.

[don-petry]

Dev-Lead Implementation Plan

Issue: #697 — [Fleet Monitor] petry-projects/.github-private — .github/workflows/ci.yml

Root-cause analysis

Categorising the last 60 ci.yml failures by failing job:

Job	Count	Nature
Lint (markdown/yaml)	~29	Genuine errors on feature branches (e.g. line too long, MD018) — CI working as intended
Secret scan (gitleaks)	~24	False positives — example/expired tokens in vendored BMAD framework & .claude/skills/** docs
ShellCheck	~8	Genuine shellcheck warnings on feature branches — CI working as intended
Compile agentic workflows	1	One-off transient (gh extension install network)

Only the gitleaks category is a false failure (CI failing when it shouldn't). The repeated finding is
const expiredToken = '<JWT>'; // Expired token in api-testing-patterns.md knowledge files, reported 9×
per run.

A comprehensive .gitleaks.toml allowlist already exists and is committed; gitleaks auto-loads it from the
--source root (verified locally with gitleaks 8.30.1 — the skills FP is suppressed, exit 0). The 27.6%
figure is a trailing-window metric that includes failures from before the allowlist landed.

The gap: tests/test_gitleaks_config.bats only validates that the TOML parses and mentions a
frameworks path. It would not catch a regression that removed the .claude/skills/**/api-testing-patterns.md
suppression — the exact condition that caused this DEGRADED alert (and its predecessor #244). This change adds
a real regression guard.

Scope

Strengthen tests/test_gitleaks_config.bats with a structural + behavioural regression guard locking in the
gitleaks suppression of the skills api-testing-patterns.md false positive, while proving the allowlist is
not over-broad (a real secret in a non-allowlisted path is still caught).

Implementation Checklist

• tests/test_gitleaks_config.bats — add structural assertion that an [[allowlists]] entry covers
  .claude/skills/**/api-testing-patterns.md
• tests/test_gitleaks_config.bats — add behavioural test: committed config suppresses the
  expiredToken JWT FP in a skills-path fixture (skips if gitleaks binary absent)
• tests/test_gitleaks_config.bats — add behavioural test: the same JWT in a non-allowlisted path is
  still detected (guards against over-broad allowlisting)

Not modifying ci.yml: gitleaks already auto-loads the committed config (verified), and AGENTS.md requires
ci.yml to track the org template; no workflow-YAML defect exists.

Tests to Write

• .gitleaks.toml allowlist covers .claude/skills api-testing-patterns.md (structural)
• gitleaks suppresses skills api-testing-patterns.md expiredToken false positive (behavioural, skip-if-absent)
• gitleaks still detects the same JWT in a non-allowlisted path (behavioural, skip-if-absent)

Test Command

bats tests/test_gitleaks_config.bats (full guard: bash .dev-lead/scripts/dev-lead-lint.sh + shellcheck scripts/**/*.sh)

[don-petry]

Dev-Lead: Implementation Complete

Root-cause summary

Categorising the last 60 ci.yml failures by failing job:

Job	~Count	Nature
Lint (markdown/yaml)	29	Genuine errors on feature branches (line too long, MD018) — CI working as intended
Secret scan (gitleaks)	24	False positives — example expired JWT in vendored bmad .claude/skills/**/api-testing-patterns.md
ShellCheck	8	Genuine shellcheck warnings on feature branches — CI working as intended
Compile agentic workflows	1	One-off transient (gh extension install)

Only the gitleaks category is a false failure. The committed .gitleaks.toml already suppresses it and
gitleaks auto-loads it from the --source root (verified with gitleaks 8.30.1). The 27.6% figure is a
trailing-window metric dominated by failures from before the allowlist fully landed; it decays as new passing
runs accumulate. I did not touch ci.yml (no workflow-YAML defect; AGENTS.md requires it to track the org
template) and did not suppress the genuine Lint/ShellCheck failures.

The remaining gap was test coverage: tests/test_gitleaks_config.bats only checked that the TOML parsed and
mentioned a frameworks path — it would not have caught a regression removing the .claude/skills/**
suppression, i.e. exactly the condition that drove this (and #244) DEGRADED. This change adds that guard.

Plan Execution

• Structural assertion: an [[allowlists]] entry covers .claude/skills/**/api-testing-patterns.md
• Behavioural test: committed config suppresses the expiredToken JWT in a skills-path fixture (skips if gitleaks absent)
• Behavioural test: the same JWT in a non-allowlisted path is still detected (guards against over-broad allowlisting)
• Verified red→green: with the skills suppression stripped, gitleaks reports the leak (exit 1); with the real config it is suppressed (exit 0)

Test Results

# tests/test_gitleaks_config.bats — WITH gitleaks on PATH
1..6
ok 1 .gitleaks.toml exists at repo root
ok 2 .gitleaks.toml is valid TOML
ok 3 .gitleaks.toml allowlist covers frameworks/ path
ok 4 .gitleaks.toml allowlist covers .claude/skills api-testing-patterns.md
ok 5 gitleaks suppresses skills api-testing-patterns.md expiredToken false positive
ok 6 gitleaks still detects the expired JWT in a non-allowlisted path

# WITHOUT gitleaks (CI bats job) — behavioural tests skip cleanly
ok 5 ... # skip gitleaks binary not installed
ok 6 ... # skip gitleaks binary not installed

# Full bats suite (lint.yml list): 262 ok, 0 not-ok
# Required lint: bash .dev-lead/scripts/dev-lead-lint.sh  ->  all checks passed (exit 0)

Files Changed

• tests/test_gitleaks_config.bats: added one structural test + two behavioural (gitleaks-run) regression tests locking in the skills api-testing-patterns.md false-positive suppression while proving real secrets in non-allowlisted paths are still caught.

Notes

• TDD note: the new structural test passes against the already-correct committed config (Phase-2 config/behaviour-preserving exception); the behavioural tests are genuine guards — demonstrated red when the skills allowlist is removed.
• Behavioural tests skip when the gitleaks binary is absent (a capability guard, not a masked failure). The bats CI job does not install gitleaks, so tests 1–4 run there and 5–6 skip. Optional follow-up: install gitleaks in the bats job of lint.yml so the behavioural guards run in CI too.
• No ci.yml changes; no PR/commit performed (handled by the CI workflow).