Compliance: stub-surface-drift-feature-ideation.yml-permissions

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: stub-surface-drift-feature-ideation.yml-permissions

Detail

The feature-ideation.yml caller stub's permissions: surface has drifted from the canonical standards/workflows/feature-ideation.yml. These stubs are thin callers — the on: triggers, permissions: grants, and concurrency: block are owned centrally and are not repo-adjustable (only the documented with: inputs and the tier channel pin may differ per repo). Re-sync permissions: from standards/workflows/feature-ideation.yml.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #330 — Compliance: stub-surface-drift-feature-ideation.yml-permissions

Scope

Re-sync .github/workflows/feature-ideation.yml with the canonical standards/workflows/feature-ideation.yml so the caller stub's permissions: surface matches the centrally-owned template.

Root Cause

The audit's check_stub_surface_drift concatenates every permissions: block in the stub (top-level + each job) and compares it to the canonical. The deployed stub is a stale revision: it predates the canonical's redispatch and prep bridge jobs (each carrying permissions: {}), so its permissions surface is missing those two {} blocks. It also still SHA-pins the reusable (@…v1) instead of the @feature-ideation/stable channel used by the sibling stubs (agent-shield, pr-auto-review). The only per-repo-adjustable field, project_context, is still the unmodified TODO placeholder in both, so nothing repo-specific is lost by re-syncing.

Implementation Checklist

• Overwrite .github/workflows/feature-ideation.yml verbatim from standards/workflows/feature-ideation.yml (fetched via gh api), per the issue's remediation ("copy the template verbatim — do not generate from scratch")

Tests to Write

• N/A — this is a configuration sync with no repo-side behavioral tests. The governing check (stub-surface-drift) lives in petry-projects/.github, not this repo. Verification is a direct surface comparison (concatenated permissions: blocks must equal the canonical). Phase 2 TDD exception noted.

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh (repo lint gate; no unit-test runner is defined for workflow YAML)

[don-petry]

Dev-Lead: Implementation Complete

Plan Execution

• Confirmed root cause: deployed stub was a stale revision missing the canonical's redispatch + prep bridge jobs, so its concatenated permissions: surface lacked their two permissions: {} blocks
• Overwrote .github/workflows/feature-ideation.yml verbatim from standards/workflows/feature-ideation.yml
• Verified file is byte-identical to canonical and permissions surface now matches
• Ran repo lint gate (.dev-lead/scripts/dev-lead-lint.sh) — passed
• Validated YAML parses cleanly

Test Results

No repo-side unit tests govern this stub — the stub-surface-drift check lives in petry-projects/.github. Verification was done by (1) reproducing the audit's permissions: block extraction/normalization and confirming it matches the canonical, and (2) the repo lint gate. Phase 2 TDD exception applies (behavior-preserving configuration sync).

  [lint] shellcheck: no .sh files found — skipping
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

Permissions surface (deployed, post-sync):
permissions: {}
    permissions: {}        # redispatch job
    permissions: {}        # prep job
    permissions:           # ideate job
      contents: read
      issues: read
      pull-requests: read
      discussions: write
      id-token: write
      actions: read

diff vs canonical standards/workflows/feature-ideation.yml: IDENTICAL
YAML parse: OK  (jobs: redispatch, prep, ideate)

Files Changed

• .github/workflows/feature-ideation.yml: re-synced verbatim to the canonical template. Adopts the newer redispatch (discussion→dispatch bridge) and prep (input resolution) jobs, restoring the two centrally-owned permissions: {} blocks that were absent. Also brings the uses: pin in line with sibling stubs (@feature-ideation/stable channel + inline # NOSONAR(githubactions:S7637) marker) and syncs the on:/concurrency: surfaces, which are owned centrally alongside permissions:.

Notes

• The only per-repo-adjustable field, project_context, was the unmodified TODO placeholder both before and after, so no repo-specific customization was lost.
• Copying verbatim (per the issue's remediation) also aligns the on: and concurrency: surfaces; these are centrally owned and were consistent with the same stale-revision drift, so re-syncing resolves them together.
• No unrelated files were modified.

[don-petry]

Weekly Compliance Audit (2026-07-24)

This finding is still open.

Detail: The feature-ideation.yml caller stub's permissions: surface has drifted from the canonical standards/workflows/feature-ideation.yml. These stubs are thin callers — the on: triggers, permissions: grants, and concurrency: block are owned centrally and are not repo-adjustable (only the documented with: inputs and the tier channel pin may differ per repo). Re-sync permissions: from standards/workflows/feature-ideation.yml.

Standard: standards/ci-standards.md#centralization-tiers