Compliance: ruleset-drift-pr-quality-require_code_owner_review

[don-petry]

Compliance Finding

Category: rulesets
Severity: error
Check: ruleset-drift-pr-quality-require_code_owner_review

Detail

Ruleset pr-quality parameter require_code_owner_review has drifted from the codified standard: expected true, actual false. The codified JSON (standards/rulesets/pr-quality.json) is the source of truth (#575/#580); run scripts/apply-rulesets.sh --repo petry-projects/markets to converge.

Standard Reference

standards/github-settings.md#pr-quality--standard-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead Implementation Plan

Issue: #419 — Compliance: ruleset-drift-pr-quality-require_code_owner_review

Scope

Converge the live pr-quality ruleset so require_code_owner_review = true, matching the codified standard that this repo already enforces.

Findings (Phase 1 investigation)

• .github/scripts/apply-pr-quality-ruleset.sh:60 already codifies require_code_owner_review: true (source-of-truth value from Relocate org-wide compliance rulesets (code-quality, pr-quality) from .github-private to .github/standards/rulesets/ .github#575/#580).
• .github/scripts/tests/apply-pr-quality-ruleset.bats:60 already asserts that value; payload simulation confirms the emitted JSON contains require_code_owner_review: true.
• CODEOWNERS has a catch-all * @petry-projects/org-leads, so code-owner review can apply to all paths.
• The value is wired into self-heal: weekly apply-repo-settings.yml → apply-repo-settings.sh → apply-pr-quality-ruleset.sh (line 66).
• Conclusion: the repository's codified standard is already compliant. The drift is a live GitHub ruleset setting that must be re-applied (admin-scoped) to converge.

Remediation

• No source-code change is warranted (the codified value is already correct — Phase 2 TDD exception: no observable behavior change).
• Converge live state by dispatching the existing idempotent self-heal workflow apply-repo-settings.yml (workflow_dispatch = "fix current state immediately"), which runs the apply chain using the admin-scoped GH_TOKEN_ADMIN secret.

Test Command

bats .github/scripts/tests/apply-pr-quality-ruleset.bats (existing coverage; already asserts require_code_owner_review: true)

[don-petry]

Dev-Lead: Investigation Complete — Root Cause Is a Missing Admin Secret (No Code Change)

Summary

The repository's codified standard is already compliant: require_code_owner_review is set to true. The live drift persists because the self-healing workflow that applies the ruleset fails on every run due to an unset/empty GH_TOKEN_ADMIN secret. This is an operational/secret fix that requires repo-admin privileges — no source-code change fixes it.

Evidence

1. Codified value is already correct

• .github/scripts/apply-pr-quality-ruleset.sh:60 → require_code_owner_review: true
• .github/scripts/tests/apply-pr-quality-ruleset.bats:60 asserts true
• Payload simulation (mocked gh) confirms emitted JSON: .rules[0].parameters.require_code_owner_review == true
• CODEOWNERS has catch-all * @petry-projects/org-leads
• Wiring: apply-repo-settings.yml → apply-repo-settings.sh (line 66) → apply-pr-quality-ruleset.sh

2. The self-heal workflow has been failing on every run (apply-repo-settings.yml)

2026-08-10 schedule   run 31363226949  → failure (7s)
2026-08-07 push #401   run 31198636642  → failure
2026-08-07 push #399   run 31188543346  → failure
2026-08-14 dispatch    run 31805313325  → failure (dispatched during this investigation)

3. Root cause — empty admin token (identical failing step in all runs):

GH_TOKEN:
ERROR: GH_TOKEN is required with administration:write scope
##[error]Process completed with exit code 1.

The workflow injects GH_TOKEN: ${{ secrets.GH_TOKEN_ADMIN }} (apply-repo-settings.yml:44), but the secret resolves to empty — i.e. GH_TOKEN_ADMIN is not configured (or expired/blank). The apply script correctly aborts, so the live pr-quality ruleset is never re-applied and require_code_owner_review stays at false. This also explains the recurrence chain (#325 → #401 → #403 → #419): the "self-heal" has never actually run to completion.

Required Remediation (admin action — outside this agent's scope)

1. Add/refresh the repository (or org) secret GH_TOKEN_ADMIN with a token that has administration:write on petry-projects/markets (fine-grained: Administration = Read/Write; or a classic PAT with repo).
2. Re-run the workflow to converge immediately:
   gh workflow run apply-repo-settings.yml --repo petry-projects/markets --ref main
   (or scripts/apply-rulesets.sh --repo petry-projects/markets from petry-projects/.github).
3. Confirm: gh api repos/petry-projects/markets/rulesets/<id> --jq '.rules[] | select(.type=="pull_request").parameters.require_code_owner_review' → true.

This dev-lead token has only repo/workflow scopes (no administration:write, no ability to set secrets), so it cannot converge the ruleset or install the secret directly.

Test Results

No source change was made (Phase 2 TDD exception: codified value already correct, no observable behavior change). Baseline checks:

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck: no .sh files found — skipping
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

$ # payload simulation
require_code_owner_review = true

$ git status --porcelain   # (empty — no changes)

Files Changed

• None. The repository's codified standard already enforces require_code_owner_review: true; the defect is a missing/empty GH_TOKEN_ADMIN secret preventing the apply workflow from running.

Notes

The correct durable fix is provisioning GH_TOKEN_ADMIN; without it, the weekly self-heal will keep failing and this compliance finding will keep recurring regardless of any repo code change.