feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml - #208
Merged
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the .gitignore file to include the .dev-lead/ directory. The reviewer noted that while the pull request title mentions the implementation of a compliance workflow, the corresponding workflow file is missing from the current changes.
don-petry
enabled auto-merge (squash)
May 20, 2026 15:02
There was a problem hiding this comment.
Pull request overview
Updates the repository’s Dev-Lead thin-caller workflow to meet the org “action pinning” compliance requirement by pinning the referenced reusable workflow to an immutable commit SHA.
Changes:
- Pin
.github/workflows/dev-lead.ymlreusable-workflow reference from@mainto a specific commit SHA. - Ignore the
.dev-lead/working directory in.gitignore.
Reviewed changes
Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.gitignore |
Adds .dev-lead/ to ignored paths to avoid committing local Dev-Lead artifacts. |
.github/workflows/dev-lead.yml |
Pins the reusable workflow reference to a commit SHA to satisfy action-pinning compliance. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
Author
Dev-Lead — fix-reviews (no-changes)No changes were needed for the open review threads. |
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
…uire_code_owner_review (#433) * Add BMAD method workspace and resume beekeeping brainstorming session * Add product brief for bmad-method outlining core vision, user journeys, and success metrics * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add zero-tap beeyard experience — core differentiator MAJOR: Broodly's key differentiator is now a zero-tap beeyard session. Once inspection starts, the user NEVER needs to tap the phone in the field. New FRs: - FR19c: Continuous multi-hive voice session (zero-tap, voice navigation) - FR19d: Per-hive context during multi-hive session (auto-save, TTS announce) - FR30c: Post-session Evening Review (tap-friendly at home) - FR19 updated: session-based not per-hive - FR27 updated: hive navigation commands (next/move to/which/how many/end) New stories: 8.8 (multi-hive voice session), 8.9 (evening review) Total: 64 stories across 12 epics Prototype: 30 screens (+3 new) - inspection-next-hive: voice transition between hives with context - inspection-session-end: session summary with stats - evening-review: tap-friendly per-hive correction UI - Homepage: "Review today's session" card added CLAUDE.md: Zero-Tap Beeyard section added as key differentiator UX spec: Continuous session + evening review patterns added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Goal slider, scale weights, card variants, voice-top plan, materials list 1. Goal Selection: replaced multi-select chips with Honey↔Splits sliding scale (competing priorities). Removed Learning/Growth. Colony health always prioritized. FR2b updated. 2. Homepage: added regional scale weight card (beecounted.org) showing daily weight trend for user's area. New FR10a, FR11c. 3. Design system: actionable cards (amber left border + chevron + hover) vs informational cards (no affordance). Applied across all prototype screens. CLAUDE.md + PRD updated. 4. Weekly Plan: Live Discussion Mode banner moved to top — users can start talking immediately. FR13 updated. 5. Weekly Plan: Required Materials checklist before apiary accordions (treatments, equipment, syrup). New FR13a. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add coding standards, Live Mode icon, notification types, and UX refinements Update CLAUDE.md with coding standards section (org standards + Broodly-specific guidelines for TypeScript, Go, and monorepo). Update PRD with FR12b2 (persistent Live Mode EQ icon), FR30c (photos/videos in Evening Review), FR40/FR40a2 (per-category notification toggles and types screen). Update UX spec with icon conventions, notification types screen, and Live Mode activation from app header. Add Live Mode icon exploration HTML files and test framework spec. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Add AGENTS.md with full project rules, slim down CLAUDE.md Follows the org convention where AGENTS.md is the comprehensive agent-agnostic file and CLAUDE.md is a Claude Code-specific summary with @import for org-wide standards. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bee87b3...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897e. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * fix: use explicit secrets and write permissions in dependabot-rebase workflow (#170) * fix: use explicit secrets and write permissions in dependabot-rebase workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs. * fix: pin reusable SHA, update header guidance, fix secrets comment Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets * fix: apply prettier formatting (single space before inline comments) * fix: apply prettier formatting to auto-rebase.yml (single space before inline comments) * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * feat: implement issue #243 — [Fleet Monitor] petry-projects/broodly — ci-failure-analyst.yml (#297) * fix(deps): pin shell-quote to >=1.8.4 to patch GHSA-w7jw-789q-3m8p Critical CVE in shell-quote <=1.8.3 allows newline injection via object .op values. Added pnpm override to force >=1.8.4 and regenerated pnpm-lock.yaml with the patched version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(deps): broaden dependency overrides to patch nested vulnerabilities Tightened pnpm dependency overrides from pattern-based constraints (e.g. tmp@<0.2.6) to unconditional versions (tmp, uuid) to ensure deeply nested vulnerable packages (e.g., tmp@0.0.33 via patch-package, js-yaml@3.14.2 via Babel/Jest) are properly patched. This resolves 5 pnpm audit violations (1 high, 3 moderate, 1 low) and regenerates pnpm-lock.yaml accordingly. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: sync org-standard pr-review-mention.yml stub from petry-projects/.github (#333) * chore: sync org-standard auto-rebase.yml stub from petry-projects/.github (#335) * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#359) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml (#397) * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: fix pnpm v11 lockfile mismatch and add @types/jest [skip ci-relay] Move overrides authority from the now-ignored package.json pnpm.overrides field to pnpm-workspace.yaml (aligned with lockfile keys). Add @types/jest as an explicit devDependency to apps/mobile so TypeScript can resolve test globals under pnpm's strict node_modules isolation. Add "types": ["jest"] to apps/mobile/tsconfig.json. Regenerate lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove unused test scripts from workspace packages Packages config, domain-types, graphql-types, test-utils, and ui have test scripts that invoke jest but contain no test files and jest is not in their devDependencies. This causes test failure when pnpm run test is executed recursively. Remove the unused scripts since these packages are type/domain libraries with no unit test coverage. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #410 — Compliance: dev-lead-stub-pin (#412) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#437) * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github (#440) * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * fix(reviews): address review comments [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Don Petry <don@petry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #193
Implemented by dev-lead agent. Please review.