fix(compliance): add CLAUDE.md and dependabot.yml

[don-petry]

Summary

• Adds CLAUDE.md with required AGENTS.md reference (fixes claude-md-missing-agents-ref)
• Adds .github/dependabot.yml with github-actions ecosystem, security and dependencies labels (fixes missing-github-actions-ecosystem, missing-security-label, missing-dependencies-label)

Compliance findings addressed

Finding	Severity	Status
claude-md-missing-agents-ref	error	✅ Fixed
missing-github-actions-ecosystem	error	✅ Fixed
missing-security-label	warning	✅ Fixed
missing-dependencies-label	warning	✅ Fixed

Remaining findings requiring human action

The following findings for .github-private require elevated permissions not available to this agent:

• Workflow files (missing-ci.yml, missing-pr-review-mention.yml, non-stub-auto-rebase.yml, non-stub-dependabot-automerge.yml, non-stub-agent-shield.yml) — require workflows write permission
• SHA pinning in workflow files (unpinned-actions-*) — require workflows write permission
• Repository settings (allow_auto_merge, delete_branch_on_merge, check-suite-auto-trigger-*) — run bash scripts/apply-repo-settings.sh .github-private with admin credentials
• Secret scanning settings — run bash scripts/apply-repo-settings.sh .github-private

Part of petry-projects/.github#261

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated internal project documentation and configuration guidelines.

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 59 minutes and 49 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 169c921b-39c2-486f-90a4-19ec36942e0b

📥 Commits

Reviewing files that changed from the base of the PR and between b34e302 and 2508628.

📒 Files selected for processing (2)

• .github/dependabot.yml
• CLAUDE.md

📝 Walkthrough

Walkthrough

Added CLAUDE.md with repository-specific Claude Code guidance, directing agents to org-wide standards in AGENTS.md, defining the .github-private repository's purpose and structure, and establishing operational rules for shell script editing and GitHub Actions SHA pinning.

Changes

Repository Development Guidance for Claude Code

Layer / File(s)	Summary
Claude Code repository guidance CLAUDE.md	New file establishes development standards for Claude Code usage in .github-private, references org-wide AGENTS.md standards, documents repository contents (agents, scripts, workflows), and defines operational rules: shell scripts must pass shellcheck and GitHub Actions must pin SHAs via GitHub API lookup.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

• Compliance: unpinned-actions-claude.yml .github#105: CLAUDE.md guidance on pinning action SHAs directly addresses the unpinned-action finding for claude.yml.
• Compliance audit — 2026-05-08 .github#215: Added CLAUDE.md in .github-private matches the requested documentation update to CLAUDE.md/AGENTS.md.
• Compliance audit — 2026-05-12 .github#261: CLAUDE.md addition with action SHA pinning and workflow practices guidance directly addresses compliance audit findings.
• Compliance audit — 2026-05-12 .github#250: Both changes modify .github-private/CLAUDE.md, adding AGENTS.md reference and action SHA pinning guidance.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title references both CLAUDE.md and dependabot.yml, but the raw summary only documents CLAUDE.md changes; dependabot.yml is not mentioned or summarized.	Either update the title to reflect only the documented changes (e.g., 'fix(compliance): add CLAUDE.md'), or confirm that dependabot.yml changes are included and ensure they are documented in the summary.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-261-compliance

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a Dependabot configuration for GitHub Actions and a CLAUDE.md file to provide context and guidelines for Claude Code. The review feedback suggests bundling Dependabot updates into groups to reduce noise, expanding the repository purpose section to include missing directories, and adding a commands section for common tasks like shell script linting.

[Copilot]

Pull request overview

Adds missing compliance artifacts for this org-level .github-private repository: Claude Code instructions and Dependabot configuration for GitHub Actions updates.

Changes:

• Add CLAUDE.md with a reference to AGENTS.md and repository-specific guidance.
• Add .github/dependabot.yml to enable weekly GitHub Actions dependency updates with security and dependencies labels.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
CLAUDE.md	Adds Claude Code repo instructions and points contributors to AGENTS.md standards.
.github/dependabot.yml	Enables Dependabot for the github-actions ecosystem with standard labels.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[donpetry-bot]

Superseded by automated re-review at 881d6da3448bdc81863695ad5150975e4723e9d2 — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[donpetry-bot]

Superseded by automated re-review at 5e0577b6e6511b9b3ebe4d5b2bbee79f622d5f5a — click to expand prior review.

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[donpetry-bot]

Superseded by automated re-review at 02c9a4b3b4f3f22f3c54920b101db0ed96d913a6 — click to expand prior review.

Review — fix requested (cycle 3/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@donpetry-bot review

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: none
Skipped (informational): 0
No actionable issues found. Quality Gate passed with zero findings.
No open review threads from sonarqubecloud[bot] to resolve.
No Tier 1 CI or review blockers present.
PR is in a clean, unblocked state.
```

[don-petry]

@donpetry-bot review

[donpetry-bot]

@don-petry I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 02c9a4b3b4f3f22f3c54920b101db0ed96d913a6
Review mode: triage-approved (single reviewer)

Summary

Small compliance PR (2 files, +44/-11): adds CLAUDE.md referencing AGENTS.md and restructures .github/dependabot.yml to add required security/dependencies labels and an actions group. Both changes are documentation/configuration only — no executable code, no auth/secrets/migrations. Triage already cleared this as low-risk; this confirmation review agrees.

Linked issue analysis

PR is "Part of petry-projects/.github#261" (the 2026-05-12 compliance audit umbrella). It targets four named findings for .github-private (claude-md-missing-agents-ref, missing-github-actions-ecosystem, missing-security-label, missing-dependencies-label) and the diff demonstrably addresses each: CLAUDE.md exists and links AGENTS.md; dependabot.yml has the github-actions ecosystem with both labels. Remaining audit findings for this repo (workflow edits, repo settings) are explicitly out-of-scope and called out in the PR description.

Findings

• CLAUDE.md — Clean, factual file: project purpose, links to AGENTS.md, distinguishes thin-caller stub workflows from org-private logic workflows, includes a ## Commands section with shellcheck scripts/*.sh. Earlier reviewer feedback from Gemini (missing prompts//frameworks/, missing Commands section) and Copilot (incorrect stub/non-stub wording) is all factually resolved in the current head; the two technically-unresolved review threads have explicit author replies confirming this and the file content matches.
• .github/dependabot.yml — Restructured to canonical form: version: 2 at top, consistent indentation, weekly schedule preserved, open-PR limit 10 preserved, github/gh-aw-actions/* ignore preserved with explanation, security/dependencies labels added, groups: actions added to bundle action updates into a single PR. Valid dependabot v2 syntax; no functional regressions.

No security, correctness, or maintainability concerns.

CI status

All required checks green: Lint, CodeQL, Analyze (actions), Analyze (python), unit-tests, ShellCheck, Secret scan (gitleaks), Agent Security Scan, agent-shield, review, Compile agentic workflows, SonarCloud, CodeRabbit. Ecosystem-specific dependency-audit jobs and dependabot-automerge correctly skipped (no matching ecosystems / not a dependabot PR).

---

Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.