Compliance: dev-lead-stub-pin

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: dev-lead-stub-pin

Detail

The dev-lead.yml caller stub must pin petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable. Re-sync from standards/workflows/dev-lead.yml.

Standard Reference

standards/ci-standards.md#dev-lead-agent

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Weekly Compliance Audit (2026-06-19)

This finding is still open.

Detail: The dev-lead.yml caller stub must pin petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable. Re-sync from standards/workflows/dev-lead.yml.

Standard: standards/ci-standards.md#dev-lead-agent

[don-petry]

Dev-Lead Implementation Plan

Issue: #272 — Compliance: dev-lead-stub-pin

Scope

Re-sync .github/workflows/dev-lead.yml from the authoritative standards/workflows/dev-lead.yml so the caller stub pins petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable (instead of a @<sha> # main pin) and threads agent_ref: dev-lead/stable.

Implementation Checklist

• Update jobs.dev-lead.uses to ...dev-lead-reusable.yml@dev-lead/stable
• Add with: agent_ref: dev-lead/stable
• Update the concurrency + uses: explanatory comments to match the standard

Tests to Write

• N/A — pure CI-workflow config sync with no observable runtime behavior to unit-test. TDD exception (configuration change) applies per Phase 2. Verification is via dev-lead-lint.sh and a byte-level diff against the upstream standard.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Updated jobs.dev-lead.uses to pin petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable (was @5a9a2476…# main)
• Added with: agent_ref: dev-lead/stable
• Updated concurrency + uses: explanatory comments to match the standard
• Verified .github/workflows/dev-lead.yml is byte-for-byte identical to upstream standards/workflows/dev-lead.yml

Test Results

No JS/test suite exists yet (no package.json/src/ — repo is still in planning/scaffolding stage). Per Phase 2, the TDD test-first step is skipped for this pure CI-workflow config sync. Verification performed:

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck on 1 file(s)...
  [lint] validating .github/CODEOWNERS...
OK: .github/CODEOWNERS
  [lint] all checks passed   (exit 0)

$ diff <upstream standards/workflows/dev-lead.yml> .github/workflows/dev-lead.yml
EXACT MATCH with upstream standard

$ python3 -c "import yaml; yaml.safe_load(open('.github/workflows/dev-lead.yml'))"
YAML valid

Files Changed

• .github/workflows/dev-lead.yml: re-synced caller stub from the authoritative standard — pins the reusable workflow to the moving @dev-lead/stable channel tag (resolving the self-host circular-dependency risk of an @<sha> # main pin), threads agent_ref: dev-lead/stable, and updates the accompanying comments.

Notes

TDD exception (configuration change, no observable runtime behavior) applied per Phase 2. No tests reference this workflow and no other repo files require changes.