feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval - #355
Merged
Merged
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
📝 WalkthroughWalkthroughThe PR adds an executable script that creates or updates the ChangesPR quality ruleset
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a script to idempotently manage the pr-quality repository ruleset for the petry-projects/markets repository, along with a suite of BATS tests to verify its configuration. The review feedback highlights two key improvement opportunities: first, removing the 2>/dev/null || true error masking on the gh api call to ensure the script fails fast on API or credential errors; second, refactoring the BATS tests to mock the gh CLI and use jq for robust JSON payload assertions instead of relying on fragile grep regular expressions.
There was a problem hiding this comment.
Pull request overview
Adds a repo-local compliance remediation script (and Bats tests) to create/update the pr-quality repository ruleset for petry-projects/markets, specifically ensuring require_last_push_approval is enforced to address the drift flagged in issue #325.
Changes:
- Added
.github/scripts/apply-pr-quality-ruleset.shto idempotently create/update thepr-qualityruleset withrequire_last_push_approval: true. - Added
.github/scripts/tests/apply-pr-quality-ruleset.batsto statically assert the script payload matches the codified standard parameters.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.
| File | Description |
|---|---|
| .github/scripts/apply-pr-quality-ruleset.sh | New GH CLI + jq script to apply the pr-quality ruleset (incl. require_last_push_approval: true). |
| .github/scripts/tests/apply-pr-quality-ruleset.bats | New Bats tests to validate the script’s static content matches expected ruleset parameters. |
Contributor
Author
Dev-Lead — review-changes (applied)Changes committed and pushed. |
don-petry
enabled auto-merge (squash)
July 21, 2026 19:45
don-petry
disabled auto-merge
July 21, 2026 19:55
don-petry
enabled auto-merge (squash)
July 21, 2026 19:57
don-petry
disabled auto-merge
July 21, 2026 20:04
don-petry
enabled auto-merge (squash)
July 21, 2026 20:05
This was referenced Jul 22, 2026
This was referenced Jul 29, 2026
🤖 CodeAnt AI — Review Status
|
codeant-ai
Bot
added
the
size:L
don-petry
disabled auto-merge
August 2, 2026 15:19
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/scripts/tests/apply-pr-quality-ruleset.bats (1)
52-64: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAssert the
bypass_actorscontract.The test does not inspect
.bypass_actors. A change that adds a permanent bypass actor or changes a bypass mode will pass this test.Assert the actor count, actor types, bypass modes, and the integration actor ID.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/tests/apply-pr-quality-ruleset.bats around lines 52 - 64, Extend the ruleset assertions in the existing test to validate the .bypass_actors contract: check the expected actor count, each actor’s type and bypass mode, and the integration actor ID. Keep the current rules and parameters assertions unchanged, and use the payload’s bypass_actors fields directly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/scripts/tests/apply-pr-quality-ruleset.bats:
- Around line 52-64: Extend the ruleset assertions in the existing test to
validate the .bypass_actors contract: check the expected actor count, each
actor’s type and bypass mode, and the integration actor ID. Keep the current
rules and parameters assertions unchanged, and use the payload’s bypass_actors
fields directly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 11513c3a-048a-4bd4-8329-7bbc78104fcb
📒 Files selected for processing (2)
.github/scripts/apply-pr-quality-ruleset.sh.github/scripts/tests/apply-pr-quality-ruleset.bats
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@68bde55...9e0d7b8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com>
* compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com>
* compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
… ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
…ub (#316) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github
…pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657]
…uire_last_push_approval
…ub (#369) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github
…deation.yml-on (#357) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
force-pushed
the
dev-lead/issue-325-20260721-1927
branch
from
August 7, 2026 00:23
4489948 to
4d866bf
Compare
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
Contributor
Author
Dev-Lead — rebase (applied)Rebase completed and pushed. |
don-petry
enabled auto-merge (squash)
August 7, 2026 00:23
codeant-ai
Bot
added
size:M
|
don-petry
added a commit
that referenced
this pull request
Aug 14, 2026
…uire_last_push_approval (#355) * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from #78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: petry-projects/.github#154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8c. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@68bde55...9e0d7b8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry
added a commit
that referenced
this pull request
Aug 14, 2026
…de-quality (#408) * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from petry-projects/markets#78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: https://github.com/petry-projects/.github/pull/154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#300) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks (#334) * feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks * fix(bot): address bot feedback [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref (#356) * feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #384 — SonarCloud: miscellaneous findings (#393) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review (#352) * feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#380) * feat: implement issue #327 — Compliance: dev-lead-stub-pin (#354) * feat: implement issue #327 — Compliance: dev-lead-stub-pin * fix(bot): address bot feedback [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (#351) * Initial commit * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add planning artifacts, UX screen prototypes, and Claude config (#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> * feat: add Epic 1 sprint planning, coding standards, and test strategy (#22) - Generate sprint-status.yaml tracking all 8 epics and 43 stories - Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD) adapted for Go + React Native/Expo stack with bounded contexts, aggregate roots, typed IDs, repository interfaces, domain events, and dependency direction rules - Define Epic 1 test strategy with 50+ test cases covering auth, role selection, manager permissions, and RBAC middleware - Reference org-level AGENTS.md to eliminate principle duplication - Update Agents.md and CLAUDE.md to reference org standards Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from petry-projects/markets#78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: https://github.com/petry-projects/.github/pull/154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval (#355) * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to th…
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Closes #325
Implemented by dev-lead agent. Please review.
Summary by CodeRabbit
Chores
Tests
CodeAnt-AI Description
Enforce pull-request approval safeguards and update the workflow release channel
What Changed
v1-stablechannel for consistent workflow updatesImpact
✅ Prevents self-approval of the latest push✅ Blocks merges with unresolved review threads✅ Enforces squash-only pull-request merges💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.