chore: add planning artifacts, UX screen prototypes, and Claude config - #6
Conversation
There was a problem hiding this comment.
Pull request overview
Adds BMAD planning artifacts and UX prototype screens to support implementation planning for the “markets” app, along with Claude project configuration/memory files.
Changes:
- Added UX screen prototypes (HTML) and a
versions.jsonindex for screen/version tracking. - Added UX design specification and an implementation readiness assessment report.
- Added Claude project guidance/config (
CLAUDE.md,.claude/settings.json, and.claude/projects/.../memory/*).
Reviewed changes
Copilot reviewed 25 out of 26 changed files in this pull request and generated 20 comments.
Show a summary per file
| File | Description |
|---|---|
_bmad-output/planning-artifacts/ux-screens/versions.json |
Index of UX screen files and version metadata. |
_bmad-output/planning-artifacts/ux-screens/vendor-home.html |
Vendor “My Markets” prototype screen. |
_bmad-output/planning-artifacts/ux-screens/onboarding-vendor.html |
Vendor onboarding flow prototypes (profile/products/markets). |
_bmad-output/planning-artifacts/ux-screens/onboarding-manager.html |
Manager onboarding + post-onboarding management prototypes. |
_bmad-output/planning-artifacts/ux-screens/onboarding-customer.html |
Customer onboarding flow prototypes (location/preferences/follow). |
_bmad-output/planning-artifacts/ux-screens/onboarding-auth.html |
Auth + role selection prototype. |
_bmad-output/planning-artifacts/ux-screens/notification-preferences.html |
Notification preferences prototype screens across roles. |
_bmad-output/planning-artifacts/ux-screens/manager-dashboard.html |
Manager dashboard prototype screen. |
_bmad-output/planning-artifacts/ux-screens/design-system-components.html |
Design system component catalog prototype. |
_bmad-output/planning-artifacts/ux-screens/design-system-colors-typography.html |
Design system tokens (colors/typography/spacing) reference. |
_bmad-output/planning-artifacts/ux-screens/customer-following.html |
Customer “Following” prototype screen. |
_bmad-output/planning-artifacts/ux-screens/customer-discover.html |
Customer “Discover” prototype screen. |
_bmad-output/planning-artifacts/ux-screens/activity-log.html |
Activity log prototype screens across roles. |
_bmad-output/planning-artifacts/ux-design-specification.md |
Comprehensive UX specification aligned to PRD/architecture. |
_bmad-output/planning-artifacts/implementation-readiness-report-2026-03-21.md |
Planning assessment of readiness, epic coverage, and gaps. |
CLAUDE.md |
Project conventions for design system, styling, Figma integration, and architecture rules. |
.claude/settings.json |
Claude plugin enablement configuration. |
.claude/projects/-home-donpetry-markets/memory/user_role.md |
Claude memory content describing user background/context. |
.claude/projects/-home-donpetry-markets/memory/reference_winston.md |
Claude memory reference note. |
.claude/projects/-home-donpetry-markets/memory/project_stack_decisions.md |
Claude memory stack decisions note. |
.claude/projects/-home-donpetry-markets/memory/project_monetization.md |
Claude memory monetization note. |
.claude/projects/-home-donpetry-markets/memory/project_agentic_showcase.md |
Claude memory methodology/showcase note. |
.claude/projects/-home-donpetry-markets/memory/MEMORY.md |
Index for the Claude memory folder. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR updates repository configuration and adds project-wide documentation: Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
e084b1e to
eae9c18
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@CLAUDE.md`:
- Around line 35-66: The fenced code block in CLAUDE.md containing the project
directory tree lacks a language specifier; update the opening fence from ``` to
```text (i.e., replace the triple backticks that start the block with ```text)
so the block is explicitly marked as plain text for proper syntax highlighting
and readability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 07c66f58-0ffa-4662-89ea-98f3c0c026cd
⛔ Files ignored due to path filters (24)
.claude/settings.jsonis excluded by!.claude/**_bmad-output/planning-artifacts/architecture.mdis excluded by!_bmad-output/**_bmad-output/planning-artifacts/epics.mdis excluded by!_bmad-output/**_bmad-output/planning-artifacts/implementation-readiness-report-2026-03-21.mdis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-design-specification.mdis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/activity-log.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/customer-discover.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/customer-following.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/design-system-colors-typography.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/design-system-components.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/manager-dashboard.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/notification-preferences.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/notifications.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/onboarding-auth.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/onboarding-customer.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/onboarding-manager.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/onboarding-vendor.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/prototype.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/vendor-home.htmlis excluded by!_bmad-output/**_bmad-output/planning-artifacts/ux-screens/versions.jsonis excluded by!_bmad-output/**_bmad-output/test-artifacts/test-design-architecture.mdis excluded by!_bmad-output/**_bmad-output/test-artifacts/test-design-progress.mdis excluded by!_bmad-output/**_bmad-output/test-artifacts/test-design-qa.mdis excluded by!_bmad-output/**_bmad-output/test-artifacts/test-design/markets-handoff.mdis excluded by!_bmad-output/**
📒 Files selected for processing (2)
.gitignoreCLAUDE.md
…nd add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…e-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@CLAUDE.md`:
- Line 34: The documentation line referencing a non-existent config.ts should be
fixed: either create a new config.ts that exports the design token structure
used elsewhere (matching the shape documented in Agents.md, e.g., token keys and
types) or update CLAUDE.md to point to the actual file that contains design
tokens (reference Agents.md or the real token file name) so the instruction is
accurate; modify the sentence that currently names config.ts to instead
reference the chosen resolution and ensure it mentions mapping Figma colors to
the design token keys used by the project.
- Around line 11-12: Update CLAUDE.md to clarify that the Figma file identified
by file key `LMawgHcglco0TG32UAQUhE` (URL
`https://www.figma.com/design/LMawgHcglco0TG32UAQUhE/Markets`) requires explicit
"Anyone with the link" sharing for unauthenticated access; verify the current
sharing setting and state whether authentication/invitation is required, and if
so add instructions for requesting access or provide a public/exported link.
Include a one-line note next to the File key/URL entry indicating the verified
access level and a contact or steps to obtain access if it is not public.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: adc84516-bb75-45c6-9e48-3697a6958508
📒 Files selected for processing (2)
Agents.mdCLAUDE.md
✅ Files skipped from review due to trivial changes (1)
- Agents.md
| - `<img>` → `<Image>` (from expo-image) | ||
| - Lists → `<FlashList>` for performance | ||
| - Map Figma Tailwind classes to NativeWind-compatible classes (NativeWind supports most Tailwind utilities) | ||
| - IMPORTANT: Map Figma colors to design tokens in `config.ts`, not raw hex values |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Verify that config.ts does not exist in the repository.
# Search for config.ts in the repository
echo "Searching for config.ts..."
fd -t f '^config\.ts$'
if [ $? -ne 0 ] || [ -z "$(fd -t f '^config\.ts$')" ]; then
echo "✗ config.ts not found in repository"
echo "This confirms the documentation references a non-existent file."
else
echo "✓ config.ts exists at the following location(s):"
fd -t f '^config\.ts$'
fi
# Also check for similar config files that might be the intended reference
echo -e "\nChecking for similar config files..."
fd -t f 'config\.(ts|js|json)$' | head -10Repository: petry-projects/markets
Length of output: 230
Fix documentation reference to non-existent config.ts file.
Line 34 instructs mapping Figma colors to design tokens in config.ts, but this file does not exist in the repository. This makes the documentation inaccurate and creates an impossible constraint for anyone attempting to follow these instructions.
Either create the config.ts file with the design token structure as specified in Agents.md, or update this line to reference the correct file where design tokens are actually stored.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@CLAUDE.md` at line 34, The documentation line referencing a non-existent
config.ts should be fixed: either create a new config.ts that exports the design
token structure used elsewhere (matching the shape documented in Agents.md,
e.g., token keys and types) or update CLAUDE.md to point to the actual file that
contains design tokens (reference Agents.md or the real token file name) so the
instruction is accurate; modify the sentence that currently names config.ts to
instead reference the chosen resolution and ensure it mentions mapping Figma
colors to the design token keys used by the project.
#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain>
#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain>
#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain>
#351) * Initial commit * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add planning artifacts, UX screen prototypes, and Claude config (#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> * feat: add Epic 1 sprint planning, coding standards, and test strategy (#22) - Generate sprint-status.yaml tracking all 8 epics and 43 stories - Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD) adapted for Go + React Native/Expo stack with bounded contexts, aggregate roots, typed IDs, repository interfaces, domain events, and dependency direction rules - Define Epic 1 test strategy with 50+ test cases covering auth, role selection, manager permissions, and RBAC middleware - Reference org-level AGENTS.md to eliminate principle duplication - Update Agents.md and CLAUDE.md to reference org standards Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from #78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: petry-projects/.github#154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8c. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@68bde55...9e0d7b8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
#351) * Initial commit * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add planning artifacts, UX screen prototypes, and Claude config (#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> * feat: add Epic 1 sprint planning, coding standards, and test strategy (#22) - Generate sprint-status.yaml tracking all 8 epics and 43 stories - Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD) adapted for Go + React Native/Expo stack with bounded contexts, aggregate roots, typed IDs, repository interfaces, domain events, and dependency direction rules - Define Epic 1 test strategy with 50+ test cases covering auth, role selection, manager permissions, and RBAC middleware - Reference org-level AGENTS.md to eliminate principle duplication - Update Agents.md and CLAUDE.md to reference org standards Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from #78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: petry-projects/.github#154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8c. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@68bde55...9e0d7b8) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
…de-quality (#408) * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from petry-projects/markets#78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: https://github.com/petry-projects/.github/pull/154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#300) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks (#334) * feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks * fix(bot): address bot feedback [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref (#356) * feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369) * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * chore: sync 2 org-standard workflow stub(s) from petry-projects/.github * feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #384 — SonarCloud: miscellaneous findings (#393) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review (#352) * feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#380) * feat: implement issue #327 — Compliance: dev-lead-stub-pin (#354) * feat: implement issue #327 — Compliance: dev-lead-stub-pin * fix(bot): address bot feedback [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (#351) * Initial commit * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add planning artifacts, UX screen prototypes, and Claude config (#6) * chore: add planning artifacts, UX screens, and Claude config Add BMAD planning output including architecture, epics, UX design specification, and UX screen prototypes. Also adds Claude Code memory and settings configuration. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Update user role description in MEMORY.md * chore: gitignore machine-specific Claude memory and remove from repo These files are per-machine Claude Code project memory that shouldn't be shared in the repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on UX prototypes and specs - Comment out remote figma capture.js script tags (security/hermetic) - Fix invalid viewport initial-scale=375 to initial-scale=1 - Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM) - Replace absolute filesystem paths with repo-relative paths in UX spec - Change filter chips from horizontal scroll to flex-wrap per design rules Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: update UX screen prototypes and add test artifacts Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier - Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity - Add `text` language specifier to CLAUDE.md directory tree code block Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions - Move project coding standards to Agents.md for use by any AI agent or developer - Keep Figma MCP workflow and asset handling rules in CLAUDE.md - CLAUDE.md now references Agents.md at the top Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> * feat: add Epic 1 sprint planning, coding standards, and test strategy (#22) - Generate sprint-status.yaml tracking all 8 epics and 43 stories - Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD) adapted for Go + React Native/Expo stack with bounded contexts, aggregate roots, typed IDs, repository interfaces, domain events, and dependency direction rules - Define Epic 1 test strategy with 50+ test cases covering auth, role selection, manager permissions, and RBAC middleware - Reference org-level AGENTS.md to eliminate principle duplication - Update Agents.md and CLAUDE.md to reference org standards Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): drop claude.yml from sweep — handled separately claude-code-action self-validates that .github/workflows/claude.yml in a PR is byte-identical to main and refuses to run if it has changed. This blocks PR-driven updates to claude.yml even with admin merge, because branch protection treats the failed claude-code check as a required gate. Keep this sweep PR focused on the other Tier 1 stubs that merge cleanly. claude.yml will be updated via a follow-up direct change. * chore: re-trigger CI after ruleset rename for centralized check names * chore: re-evaluate merge state --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80) Closes #79. The file was already a thin caller stub but pointed at @main. Bumps to @v1 (the canonical pinned version, see petry-projects/.github#88) and prepends the standardized SOURCE OF TRUTH header so future agents know what they may and may not edit. This was deferred from petry-projects/markets#78 because claude-code-action's GitHub App refuses to mint a token for any PR whose diff includes a workflow file, and `claude-code / claude` was previously a required status check on this repo. The check is no longer required (removed yesterday from ruleset 14805963 and from classic branch protection), so the expected `claude-code / claude` job failure on this PR will be a non-blocking warning rather than a merge gate. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> * chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#140) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml To: petry-projects/.github/workflows/claude-code-reusable.yml The path syntax was incorrect. When calling a reusable workflow from another repository, the format is owner/repo/path/to/workflow. The first .github is the repository name, not a path segment. This fix resolves the "claude-code / claude" CI failure. Relates to: https://github.com/petry-projects/.github/pull/154 Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)" This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: standardize CODEOWNERS on @petry-projects/org-leads (#153) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * docs(codeowners): tighten comment to match org standard format (#160) Update the CODEOWNERS header comment to be more concise and explicit about the org standard rule (org-leads must be first on every line), matching the recommended style from petry-projects/.github standards/codeowners-standard.md. Closes #155 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * fix: move CODEOWNERS to repo root for compliance audit compatibility (#167) The compliance audit script checks CODEOWNERS locations in order: root, .github/, docs/. A bug in the audit's gh_api wrapper causes 404 responses from the root-path check to be treated as valid (non-empty) content, short-circuiting the loop before it reaches the correct .github/CODEOWNERS. Moving the file to the repo root ensures it is found on the first check, bypassing the 404-handling bug and making the audit pass. Closes #165 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174) * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml * fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check * fix(ruleset): correct required status check context to dev-lead/dispatch The check context emitted by dev-lead.yml is `dev-lead / dispatch` (caller job name / reusable job name), not `Dev-Lead Agent / dispatch` (which would use the workflow name instead of the job name). Verified against actual check names in broodly and TalkTerm PRs. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.5 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#122) * compliance: confirm and re-apply allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API (gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true). The dependabot-automerge.yml workflow already matches the org template verbatim. Recurring null findings in the compliance audit are due to ORG_SCORECARD_TOKEN lacking admin scope to read this field from the GitHub REST API — a false positive at the audit level. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (#103) * compliance: confirm allow_auto_merge is enabled (closes #89) The repository setting allow_auto_merge is already true and .github/workflows/dependabot-automerge.yml exists verbatim from the org standard template. This commit formally closes the compliance finding. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * compliance: confirm allow_auto_merge is enabled (closes #89) (#130) * compliance: re-apply and confirm allow_auto_merge=true (closes #89) Repository setting allow_auto_merge has been verified and re-applied via GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true The dependabot-automerge.yml workflow is already present and matches the org template verbatim. Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the administration:read permission needed to read allow_auto_merge from the GitHub REST API. Without admin scope, the field returns null even though the setting is enabled — a false positive. To permanently resolve, grant ORG_SCORECARD_TOKEN admin-level access to the repository in petry-projects/.github settings. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #93 — Compliance: stray-codeql-workflow (#196) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250) * feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263) * feat: implement issue #96 — Compliance: secret_scan_ci_job_present * fix(bot): address bot feedback [skip ci-relay] * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Don Petry <don@djpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval (#355) * chore: add Dependabot with auto-merge via GitHub App (#2) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: remove gradle ecosystem from Dependabot config (#4) * chore: add AGPL-3.0 + commercial dual licensing and CLA Establish dual licensing model: - AGPL-3.0 for open-source use - Commercial license available for proprietary use - Contributor License Agreement for all contributions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address review feedback — fix naming, wording, and license format - Capitalize project name in README heading - Fix AGPL description wording to be more accurate - Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing - Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: standardize LICENSE file format and add copyright notice (#7) * fix: standardize LICENSE file format and add copyright notice Remove the "This program is free software..." preamble that was prepended before the standard AGPL-3.0 text, which caused GitHub to classify the license as "Other" instead of AGPL-3.0. Add project copyright notice. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(license): remove copyright line from verbatim AGPL-3.0 text The FSF requires the LICENSE file to contain the verbatim AGPL-3.0 text without modifications. The project copyright is already in the NOTICE file where it belongs. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@donpetry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: refine CodeRabbit config to exclude non-code directories (#10) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#12) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#20) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#15) - Scope workflow token permissions to least privilege (#16) - Pin action dependencies to SHAs (#17) - Add CodeQL SAST workflow for all commits (#18) - Ensure CI runs on all PRs (#19) Closes #15, #16, #17, #18, #19 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) in all workflow files (claude, codeql, dependabot-automerge, sonarcloud) - Add concrete security contact email to SECURITY.md - No CI test workflow needed: repo contains no source code or tests Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * fix: use relative URL for security advisory link Address CodeRabbit nitpick — relative URL works for forks/renames. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: skip Claude Code reviewer on Dependabot PRs (#36) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#37) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#53) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#54) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#63) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#64) * chore: add CODEOWNERS file for code owner review enforcement Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS assigning @don-petry as the default owner for all files. Closes #52 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#78) * chore(workflows): adopt centralized stubs from petry-projects/.github Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to th…



Summary
These are planning artifacts generated during the BMAD methodology workflow and Claude Code project configuration. No application code changes.
Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation