ci: add agent-shield.yml workflow

[don-petry]

Summary

• Adds the required agent-shield.yml workflow, copied verbatim from the org standard template at petry-projects/.github/standards/workflows/agent-shield.yml
• Thin-caller stub that delegates all logic to petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1
• Triggers on push and pull_request to main, with contents: read permissions only

Closes #74

Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Implemented AgentShield automated workflow that runs security and quality checks on code changes to the main branch via pull requests and commits.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8770a1b1-bf05-465c-8f90-d9d417c97aaf

📥 Commits

Reviewing files that changed from the base of the PR and between d8bc47a and 3f7c43d.

📒 Files selected for processing (1)

• .github/workflows/agent-shield.yml

---

📝 Walkthrough

Walkthrough

This PR adds a new GitHub Actions workflow file that serves as a thin caller to an organization-level reusable workflow. The workflow triggers on push and pull request events to the main branch, delegating execution to the organization's centralized agent-shield reusable workflow.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow .github/workflows/agent-shield.yml	New workflow file that acts as a caller stub, delegating to the org-level petry-projects/.github/workflows/agent-shield-reusable.yml@v1 workflow on push and pull_request events to main branch with read-only permissions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related issues

• Compliance: missing-agent-shield.yml #74: Directly addresses the compliance finding for missing agent-shield.yml workflow file by implementing the required workflow as specified in org standards.

Possibly related PRs

• feat: switch to org-level reusable Claude Code workflow #80: Both PRs implement thin caller workflows that delegate execution to organization-level reusable workflows, following the same pattern for centralizing CI/CD configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the agent-shield.yml workflow file to the CI configuration.
Linked Issues check	✅ Passed	The pull request successfully addresses issue #74 by adding the required agent-shield.yml workflow file with correct configuration matching org standards.
Out of Scope Changes check	✅ Passed	All changes are directly related to addressing the compliance requirement; only the required agent-shield.yml workflow file was added with no extraneous modifications.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-74-20260408-2242

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[don-petry]

Self-review complete. The file was copied verbatim from the org standard template at petry-projects/.github/standards/workflows/agent-shield.yml.

Check	Result
Copied verbatim from org standard template	✓
Thin-caller pattern (delegates to reusable)	✓
permissions: contents: read at workflow level	✓
Correct triggers: push + pull_request on main	✓
Job name agent-shield (required status check name preserved)	✓
No unnecessary customisation	✓

@don-petry — as CODEOWNERS for .github/, please review and merge.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Adds the missing required AgentShield GitHub Actions workflow to bring the repo into compliance by delegating execution to the org-standard reusable workflow in petry-projects/.github.

Changes:

• Introduces .github/workflows/agent-shield.yml as a thin-caller workflow.
• Triggers AgentShield on push and pull_request events targeting main.
• Sets minimal workflow permissions (contents: read) and delegates to petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.