Skip to content

chore: add planning artifacts, UX screen prototypes, and Claude config - #6

Merged
don-petry merged 7 commits into
mainfrom
chore/planning-artifacts-and-config
Mar 28, 2026
Merged

chore: add planning artifacts, UX screen prototypes, and Claude config#6
don-petry merged 7 commits into
mainfrom
chore/planning-artifacts-and-config

Conversation

@don-petry

@don-petry don-petry commented Mar 25, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Add BMAD planning output: architecture decisions, epics breakdown, UX design specification, and implementation readiness report
  • Add interactive UX screen prototypes (HTML) for all major app flows: onboarding, customer discovery, vendor home, manager dashboard, notifications, and design system documentation
  • Add Claude Code memory bank and settings configuration for the project

These are planning artifacts generated during the BMAD methodology workflow and Claude Code project configuration. No application code changes.

Test plan

  • Verify planning artifacts render correctly in GitHub markdown viewer
  • Verify UX screen HTML files open correctly in a browser

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores

    • Updated version control to exclude machine-specific project memory files.
  • Documentation

    • Added comprehensive documentation establishing workflow rules, design-to-implementation conventions, asset handling, approved tech stack, component and styling guidelines, accessibility and mobile UX requirements, testing expectations, and event/audit patterns.

Copilot AI review requested due to automatic review settings March 25, 2026 13:29

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds BMAD planning artifacts and UX prototype screens to support implementation planning for the “markets” app, along with Claude project configuration/memory files.

Changes:

  • Added UX screen prototypes (HTML) and a versions.json index for screen/version tracking.
  • Added UX design specification and an implementation readiness assessment report.
  • Added Claude project guidance/config (CLAUDE.md, .claude/settings.json, and .claude/projects/.../memory/*).

Reviewed changes

Copilot reviewed 25 out of 26 changed files in this pull request and generated 20 comments.

Show a summary per file
File Description
_bmad-output/planning-artifacts/ux-screens/versions.json Index of UX screen files and version metadata.
_bmad-output/planning-artifacts/ux-screens/vendor-home.html Vendor “My Markets” prototype screen.
_bmad-output/planning-artifacts/ux-screens/onboarding-vendor.html Vendor onboarding flow prototypes (profile/products/markets).
_bmad-output/planning-artifacts/ux-screens/onboarding-manager.html Manager onboarding + post-onboarding management prototypes.
_bmad-output/planning-artifacts/ux-screens/onboarding-customer.html Customer onboarding flow prototypes (location/preferences/follow).
_bmad-output/planning-artifacts/ux-screens/onboarding-auth.html Auth + role selection prototype.
_bmad-output/planning-artifacts/ux-screens/notification-preferences.html Notification preferences prototype screens across roles.
_bmad-output/planning-artifacts/ux-screens/manager-dashboard.html Manager dashboard prototype screen.
_bmad-output/planning-artifacts/ux-screens/design-system-components.html Design system component catalog prototype.
_bmad-output/planning-artifacts/ux-screens/design-system-colors-typography.html Design system tokens (colors/typography/spacing) reference.
_bmad-output/planning-artifacts/ux-screens/customer-following.html Customer “Following” prototype screen.
_bmad-output/planning-artifacts/ux-screens/customer-discover.html Customer “Discover” prototype screen.
_bmad-output/planning-artifacts/ux-screens/activity-log.html Activity log prototype screens across roles.
_bmad-output/planning-artifacts/ux-design-specification.md Comprehensive UX specification aligned to PRD/architecture.
_bmad-output/planning-artifacts/implementation-readiness-report-2026-03-21.md Planning assessment of readiness, epic coverage, and gaps.
CLAUDE.md Project conventions for design system, styling, Figma integration, and architecture rules.
.claude/settings.json Claude plugin enablement configuration.
.claude/projects/-home-donpetry-markets/memory/user_role.md Claude memory content describing user background/context.
.claude/projects/-home-donpetry-markets/memory/reference_winston.md Claude memory reference note.
.claude/projects/-home-donpetry-markets/memory/project_stack_decisions.md Claude memory stack decisions note.
.claude/projects/-home-donpetry-markets/memory/project_monetization.md Claude memory monetization note.
.claude/projects/-home-donpetry-markets/memory/project_agentic_showcase.md Claude memory methodology/showcase note.
.claude/projects/-home-donpetry-markets/memory/MEMORY.md Index for the Claude memory folder.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread _bmad-output/planning-artifacts/ux-screens/design-system-components.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/customer-following.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/customer-discover.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/customer-following.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/onboarding-vendor.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/activity-log.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/onboarding-customer.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/customer-discover.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/vendor-home.html Outdated
Comment thread _bmad-output/planning-artifacts/ux-screens/notification-preferences.html Outdated
Don Petry and others added 5 commits March 28, 2026 09:04
Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Mar 28, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

This PR updates repository configuration and adds project-wide documentation: .gitignore now excludes Claude Code machine-specific project memory files, and two new docs (CLAUDE.md, Agents.md) define Figma-to-code rules, stack conventions, styling/component standards, accessibility, testing, and backend event-driven contracts.

Changes

Cohort / File(s) Summary
Configuration
.gitignore
Added entries to exclude Claude Code machine-specific project memory files (.claude/projects/-home-*).
Design & Figma workflow
CLAUDE.md
New document prescribing Figma MCP workflow (get_design_context → get_metadata fallback, require get_screenshot), asset handling (use Figma MCP assets, store under assets/, use expo-image), mapping rules to Gluestack UI v3 and NativeWind, token usage, navigation conventions, and allowed icon sources.
Project standards & architecture
Agents.md
New comprehensive project standards covering frontend/backend tech stack (React Native/Expo, TypeScript, Expo Router, Gluestack UI v3, NativeWind, Apollo/GraphQL, Go/gqlgen on Cloud Run, Firebase), component/layout organization, styling/naming/accessibility rules, mobile UX expectations, testing requirements, event-driven backend contract (audit logging, domain events, session variables), and forbidden patterns.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name Status Explanation Resolution
Title check ❓ Inconclusive The PR title partially aligns with the changeset, referring to Claude config and planning artifacts, but misrepresents the actual contents: the commit summary shows CLAUDE.md and Agents.md (documentation standards), not UX screen prototypes or planning outputs in the current changes. Clarify the scope: confirm whether the title should reflect only the current changeset (CLAUDE.md + Agents.md + .gitignore) or if planning artifacts and prototypes are in separate files not shown in the raw summary.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/planning-artifacts-and-config

Comment @coderabbitai help to get the list of available commands and usage tips.

@don-petry
don-petry force-pushed the chore/planning-artifacts-and-config branch from e084b1e to eae9c18 Compare March 28, 2026 16:05

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CLAUDE.md`:
- Around line 35-66: The fenced code block in CLAUDE.md containing the project
directory tree lacks a language specifier; update the opening fence from ``` to
```text (i.e., replace the triple backticks that start the block with ```text)
so the block is explicitly marked as plain text for proper syntax highlighting
and readability.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 07c66f58-0ffa-4662-89ea-98f3c0c026cd

📥 Commits

Reviewing files that changed from the base of the PR and between 72d45b3 and eae9c18.

⛔ Files ignored due to path filters (24)
  • .claude/settings.json is excluded by !.claude/**
  • _bmad-output/planning-artifacts/architecture.md is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/epics.md is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/implementation-readiness-report-2026-03-21.md is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-design-specification.md is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/activity-log.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/customer-discover.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/customer-following.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/design-system-colors-typography.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/design-system-components.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/manager-dashboard.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/notification-preferences.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/notifications.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/onboarding-auth.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/onboarding-customer.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/onboarding-manager.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/onboarding-vendor.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/prototype.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/vendor-home.html is excluded by !_bmad-output/**
  • _bmad-output/planning-artifacts/ux-screens/versions.json is excluded by !_bmad-output/**
  • _bmad-output/test-artifacts/test-design-architecture.md is excluded by !_bmad-output/**
  • _bmad-output/test-artifacts/test-design-progress.md is excluded by !_bmad-output/**
  • _bmad-output/test-artifacts/test-design-qa.md is excluded by !_bmad-output/**
  • _bmad-output/test-artifacts/test-design/markets-handoff.md is excluded by !_bmad-output/**
📒 Files selected for processing (2)
  • .gitignore
  • CLAUDE.md

Comment thread CLAUDE.md Outdated
…nd add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@don-petry don-petry changed the title chore: add planning artifacts, UX screens, and Claude config chore: add planning artifacts, UX screen prototypes, and Claude config Mar 28, 2026
…e-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CLAUDE.md`:
- Line 34: The documentation line referencing a non-existent config.ts should be
fixed: either create a new config.ts that exports the design token structure
used elsewhere (matching the shape documented in Agents.md, e.g., token keys and
types) or update CLAUDE.md to point to the actual file that contains design
tokens (reference Agents.md or the real token file name) so the instruction is
accurate; modify the sentence that currently names config.ts to instead
reference the chosen resolution and ensure it mentions mapping Figma colors to
the design token keys used by the project.
- Around line 11-12: Update CLAUDE.md to clarify that the Figma file identified
by file key `LMawgHcglco0TG32UAQUhE` (URL
`https://www.figma.com/design/LMawgHcglco0TG32UAQUhE/Markets`) requires explicit
"Anyone with the link" sharing for unauthenticated access; verify the current
sharing setting and state whether authentication/invitation is required, and if
so add instructions for requesting access or provide a public/exported link.
Include a one-line note next to the File key/URL entry indicating the verified
access level and a contact or steps to obtain access if it is not public.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: adc84516-bb75-45c6-9e48-3697a6958508

📥 Commits

Reviewing files that changed from the base of the PR and between 94549ae and a809d78.

📒 Files selected for processing (2)
  • Agents.md
  • CLAUDE.md
✅ Files skipped from review due to trivial changes (1)
  • Agents.md

Comment thread CLAUDE.md
Comment thread CLAUDE.md
- `<img>` → `<Image>` (from expo-image)
- Lists → `<FlashList>` for performance
- Map Figma Tailwind classes to NativeWind-compatible classes (NativeWind supports most Tailwind utilities)
- IMPORTANT: Map Figma colors to design tokens in `config.ts`, not raw hex values

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Verify that config.ts does not exist in the repository.

# Search for config.ts in the repository
echo "Searching for config.ts..."
fd -t f '^config\.ts$'

if [ $? -ne 0 ] || [ -z "$(fd -t f '^config\.ts$')" ]; then
  echo "✗ config.ts not found in repository"
  echo "This confirms the documentation references a non-existent file."
else
  echo "✓ config.ts exists at the following location(s):"
  fd -t f '^config\.ts$'
fi

# Also check for similar config files that might be the intended reference
echo -e "\nChecking for similar config files..."
fd -t f 'config\.(ts|js|json)$' | head -10

Repository: petry-projects/markets

Length of output: 230


Fix documentation reference to non-existent config.ts file.

Line 34 instructs mapping Figma colors to design tokens in config.ts, but this file does not exist in the repository. This makes the documentation inaccurate and creates an impossible constraint for anyone attempting to follow these instructions.

Either create the config.ts file with the design token structure as specified in Agents.md, or update this line to reference the correct file where design tokens are actually stored.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@CLAUDE.md` at line 34, The documentation line referencing a non-existent
config.ts should be fixed: either create a new config.ts that exports the design
token structure used elsewhere (matching the shape documented in Agents.md,
e.g., token keys and types) or update CLAUDE.md to point to the actual file that
contains design tokens (reference Agents.md or the real token file name) so the
instruction is accurate; modify the sentence that currently names config.ts to
instead reference the chosen resolution and ensure it mentions mapping Figma
colors to the design token keys used by the project.

@don-petry
don-petry merged commit f284f6c into main Mar 28, 2026
10 checks passed
@don-petry
don-petry deleted the chore/planning-artifacts-and-config branch March 28, 2026 20:26
don-petry added a commit that referenced this pull request Jun 1, 2026
#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
don-petry added a commit that referenced this pull request Jun 19, 2026
#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
don-petry added a commit that referenced this pull request Aug 4, 2026
#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
don-petry added a commit that referenced this pull request Aug 7, 2026
#351)

* Initial commit

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add planning artifacts, UX screen prototypes, and Claude config (#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>

* feat: add Epic 1 sprint planning, coding standards, and test strategy (#22)

- Generate sprint-status.yaml tracking all 8 epics and 43 stories
- Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD)
  adapted for Go + React Native/Expo stack with bounded contexts,
  aggregate roots, typed IDs, repository interfaces, domain events,
  and dependency direction rules
- Define Epic 1 test strategy with 50+ test cases covering auth,
  role selection, manager permissions, and RBAC middleware
- Reference org-level AGENTS.md to eliminate principle duplication
- Update Agents.md and CLAUDE.md to reference org standards

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...88c168b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...1eddb33)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See petry-projects/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see petry-projects/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from #78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5c8a8a6...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: petry-projects/.github#154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8c.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...e46ed2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e46ed2c...68bde55)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...9e0d7b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry added a commit that referenced this pull request Aug 14, 2026
#351)

* Initial commit

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add planning artifacts, UX screen prototypes, and Claude config (#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>

* feat: add Epic 1 sprint planning, coding standards, and test strategy (#22)

- Generate sprint-status.yaml tracking all 8 epics and 43 stories
- Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD)
  adapted for Go + React Native/Expo stack with bounded contexts,
  aggregate roots, typed IDs, repository interfaces, domain events,
  and dependency direction rules
- Define Epic 1 test strategy with 50+ test cases covering auth,
  role selection, manager permissions, and RBAC middleware
- Reference org-level AGENTS.md to eliminate principle duplication
- Update Agents.md and CLAUDE.md to reference org standards

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...88c168b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...1eddb33)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See petry-projects/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see petry-projects/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from #78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5c8a8a6...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: petry-projects/.github#154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8c.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...e46ed2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e46ed2c...68bde55)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...9e0d7b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry added a commit that referenced this pull request Aug 14, 2026
…de-quality (#408)

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See petry-projects/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see petry-projects/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from petry-projects/markets#78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: https://github.com/petry-projects/.github/pull/154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#300)

* ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549)

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316)

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks (#334)

* feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks

* fix(bot): address bot feedback [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref (#356)

* feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>

* chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #384 — SonarCloud: miscellaneous findings (#393)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review (#352)

* feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review

* chore: dev-lead update (review-changes) [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#380)

* feat: implement issue #327 — Compliance: dev-lead-stub-pin (#354)

* feat: implement issue #327 — Compliance: dev-lead-stub-pin

* fix(bot): address bot feedback [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (#351)

* Initial commit

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add planning artifacts, UX screen prototypes, and Claude config (#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>

* feat: add Epic 1 sprint planning, coding standards, and test strategy (#22)

- Generate sprint-status.yaml tracking all 8 epics and 43 stories
- Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD)
  adapted for Go + React Native/Expo stack with bounded contexts,
  aggregate roots, typed IDs, repository interfaces, domain events,
  and dependency direction rules
- Define Epic 1 test strategy with 50+ test cases covering auth,
  role selection, manager permissions, and RBAC middleware
- Reference org-level AGENTS.md to eliminate principle duplication
- Update Agents.md and CLAUDE.md to reference org standards

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See petry-projects/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see petry-projects/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from petry-projects/markets#78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: https://github.com/petry-projects/.github/pull/154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval (#355)

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to th…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants