feat: implement issue #16 — Compliance: secret_scan_ci_job_present

[don-petry]

Closes #16

Implemented by dev-lead agent. Please review.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 37 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: debf6ab8-821a-4274-973b-b28a1505f156

📥 Commits

Reviewing files that changed from the base of the PR and between 866425e and ea627c4.

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• .gitleaks.toml
• pyproject.toml
• tests/conftest.py
• tests/test_ci_compliance.py
• tests/test_contract.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-16-20260703-1421

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Implements the org push-protection compliance requirement secret_scan_ci_job_present by adding a secret-scan (gitleaks) job to the primary CI workflow, plus lightweight tests to enforce that the workflow and required .gitleaks.toml remain present and correctly configured. It also refines the existing test suite so live API contract tests are explicitly marked and skipped only when the API key is absent, allowing offline compliance checks to always run in CI.

Changes:

• Added secret-scan job to .github/workflows/ci.yml that installs and runs gitleaks with full-history checkout and required flags.
• Added offline compliance tests to assert the presence/configuration of the secret-scan job and root .gitleaks.toml.
• Introduced a live pytest marker and updated collection-time skipping to only skip tests marked live when BROODMINDER_API_KEY is not set.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/ci.yml	Adds the required secret-scan gitleaks job (full-history checkout + checksum-verified install + configured detect command).
.gitleaks.toml	Adds required repo-root gitleaks config with an allowlist section (incl. _bmad/).
tests/test_ci_compliance.py	Adds text-based tests to enforce presence/config correctness of the secret-scan job and .gitleaks.toml.
tests/conftest.py	Updates collection hook to skip only live-marked tests when no API key is set, keeping offline tests runnable in CI.
tests/test_contract.py	Marks the contract test module as live to align with the new skipping behavior.
pyproject.toml	Registers the live marker to avoid unknown-marker warnings and document intent.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[don-petry]

Dev-Lead — waiting on PR blockers (intent: review-changes)

PR: #19
No changes were committed, but the PR still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews). The retry cron will re-attempt automatically. Next attempt after: 2026-07-03T15:01:58Z

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-03T15:01:58Z

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[don-petry]

Note

@don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically.
Next attempt after: 2026-07-03T15:12:52Z

[don-petry]

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

- 0 Accepted issues  
- 0 Security Hotspots
- Quality Gate: ✅ Passed
---
## Summary
**Bot:** SonarCloud
**Status:** ✅ No actionable issues
**Issues addressed:** 0
The SonarCloud Quality Gate has passed with zero new issues, zero security hotspots, and zero accepted issues. All CI checks are passing. There are no actionable items from the bot comment, and no reviews request changes.
The PR is ready for merge.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Dev-Lead — rebase (applied)

Rebase completed and pushed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Looking at the bot comment and PR state, I can see that **all checks are passing with no issues reported**:
- ✅ SonarCloud Quality Gate: **passed** with **0 New issues**, 0 Security Hotspots, 0.0% coverage and duplication gaps
- ✅ All CI checks: completed successfully (build-and-test, CodeQL, Secret scan, SonarCloud, AgentShield, dependency-audit, etc.)
- ✅ No **Tier 1 blockers**: no failed checks, no CHANGES_REQUESTED reviews, no stale findings
The SonarCloud comment is purely informational—it's announcing successful compliance rather than flagging problems.
**No changes required.** The PR is in good shape and ready to merge.

[donpetry-bot]

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: ea627c47ff8177abb6c4cd94e1fee54080449d5d
Review mode: triage-approved (single reviewer)

Summary

Adds a gitleaks secret-scan job to CI plus a root .gitleaks.toml and offline compliance tests, implementing the org push-protection standard (secret_scan_ci_job_present) from issue #16. Also replaces the 'compliance' pytest marker with a 'live' marker so offline compliance tests always run in CI while live API contract tests skip without a key. This head SHA is a rebase onto main of content previously approved by the single-reviewer at 6af31a5 — the PR diff is unchanged. Security-critical pins re-verified: actions/checkout@de0fac2e matches the v6.0.2 tag via the GitHub API, and the gitleaks 8.30.1 linux_x64 checksum matches the official release checksums file. Workflow uses least-privilege permissions (contents: read).

Linked issue analysis

Issue #16 (Compliance: secret_scan_ci_job_present) requires ci.yml to run gitleaks per standards/push-protection.md#required-ci-job. The PR adds a 'secret-scan' job running 'gitleaks detect --source . --config .gitleaks.toml --redact --verbose --exit-code 1' with full-history checkout, and ships the required root .gitleaks.toml. Offline tests (tests/test_ci_compliance.py) lock in the job's presence, checksum-verified install, and config. Issue substantively addressed; PR will close it on merge.

Findings

No blocking findings.

• Verified: actions/checkout pinned to de0fac2e4500dabe0009e67214ff5f5447ce83dd == v6.0.2 tag (GitHub API lookup).
• Verified: GITLEAKS_CHECKSUM 551f6fc8… matches the official gitleaks v8.30.1 linux_x64 checksum.
• Note: .gitleaks.toml allowlists the '_bmad/' path (documented as BMAD knowledge/config false positives); acceptable but keep the allowlist narrow.
• The single resolved review thread (Copilot: stale v4 reference in the SHA-lookup comment) was addressed — the comment now references v6.0.2.
• MCP run_secret_scanning tool unavailable in this environment; relied on the green gitleaks CI check. No secrets present in the diff (the hex string is a published release checksum).

CI status

All validation checks green: build-and-test, CodeQL (actions + python), agent-shield, gitleaks secret scan, pip-audit, SonarCloud quality gate (0 new issues, 0 hotspots). The two CANCELLED entries (dev-lead / dispatch, dev-lead / ci-relay) are agent-orchestration jobs, not code validation.

---

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.