Compliance: non-stub-dependency-audit.yml

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: non-stub-dependency-audit.yml

Detail

Centralized workflow dependency-audit.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependency-audit.yml which delegates to petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #796 — Compliance: non-stub-dependency-audit.yml

Scope

Re-pin .github/workflows/dependency-audit.yml to the canonical org stub that delegates to dependency-audit-reusable.yml@v1, replacing the drifted @v2 ref, and align the stub-validation test with the org source of truth.

Root cause

The workflow currently calls the reusable at @v1 vs the org standard @v1. The dedicated stub test (tests/dev-lead/integration/test_dependency_audit_stub.py) hardcodes the non-compliant @v2 as its expected value, so it currently enforces the drift rather than the standard. Both must move to @v1 (the value in the canonical template standards/workflows/dependency-audit.yml).

Implementation Checklist

• tests/dev-lead/integration/test_dependency_audit_stub.py — update EXPECTED_USES + docstring from @v2 to @v1 (the org source of truth)
• .github/workflows/dependency-audit.yml — replace verbatim with canonical stub (uses: ...dependency-audit-reusable.yml@v1)

Tests to Write

• Reuse the existing dedicated test test_dependency_audit_stub.py; flip its expectation to @v1 first so it fails red against the current @v2 file, then implement the workflow fix to make it pass green.

Test Command

python3 tests/dev-lead/integration/test_dependency_audit_stub.py (plus repo lint bash .dev-lead/scripts/dev-lead-lint.sh)

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Updated the dedicated stub test to enforce the org source-of-truth ref @v1 (TDD red)
• Replaced .github/workflows/dependency-audit.yml verbatim with the canonical stub from standards/workflows/dependency-audit.yml (@v1)
• Verified stub test green, sibling regression green, repo lint green

Root cause

The workflow delegated to dependency-audit-reusable.yml@v2, but the org standard (canonical template standards/workflows/dependency-audit.yml) pins @v1. The dedicated test tests/dev-lead/integration/test_dependency_audit_stub.py hardcoded the non-compliant @v2, so it was enforcing the drift rather than the standard. Both were realigned to @v1. The workflow was copied verbatim from the canonical template via the gh api ... | base64 -d remediation command, yielding a single effective line change (the uses: ref).

Test Results

=== stub test ===
PASS: .github/workflows/dependency-audit.yml job 'dependency-audit' delegates to petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1
exit=0

=== sibling auto-rebase stub test (regression) ===
PASS: .github/workflows/auto-rebase.yml correctly references petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v2
exit=0

=== workflow permission tests (regression) ===
PASS: .github/workflows/issue-triage-runner.yml has a top-level 'permissions: {}' declaration.
PASS: caller template grants >= every permission the reusable jobs request.

=== repo lint (.dev-lead/scripts/dev-lead-lint.sh) ===
  [lint] shellcheck on 67 file(s)...
  [lint] validating 4 agent profile(s)...
  [lint] all checks passed
exit=0

Files Changed

• .github/workflows/dependency-audit.yml: re-pinned the uses: ref from dependency-audit-reusable.yml@v2 to @v1 (canonical stub, copied verbatim from the org template).
• tests/dev-lead/integration/test_dependency_audit_stub.py: updated EXPECTED_USES, docstring, and the fix-hint message from @v2 to @v1 so the test enforces the org source of truth instead of the drifted value.

Notes

• The test-expectation edit is a correction of a stale expectation, not a workaround to force a pass: the org standard and canonical template are authoritative at @v1, and the issue explicitly directs @v1. The test previously encoded the non-compliant @v2.
• scripts/lib/consumer-manifest.json references dependency-audit-reusable.yml only by path (no version pin), so no change was required there.
• No other dependency-audit-reusable.yml@v2 references remain in the repo (verified by grep).