Skip to content

Compliance audit — 2026-05-11 #241

Closed
#243
Closed
Compliance audit — 2026-05-11#241
#243
Labels
compliance-auditAutomated compliance audit finding

Description

@don-petry
don-petry
opened on May 11, 2026

Compliance Audit — 2026-05-11

This umbrella issue tracks all findings from the automated compliance audit run on 2026-05-11.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 139 across 8 repositories

Remediation Work Breakdown

Repository Settings (46 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo Check Severity
.github-private allow_auto_merge warning
.github-private delete_branch_on_merge warning
.github-private codeowners-org-leads-not-first error
.github-private codeowners-no-catchall warning
.github-private check-suite-auto-trigger-1236702 error
.github-private check-suite-auto-trigger-347564 error
google-app-scripts allow_auto_merge warning
google-app-scripts delete_branch_on_merge warning
google-app-scripts codeowners-org-leads-not-first error
google-app-scripts codeowners-no-catchall warning
google-app-scripts check-suite-auto-trigger-1236702 error
google-app-scripts check-suite-auto-trigger-347564 error
ContentTwin allow_auto_merge warning
ContentTwin delete_branch_on_merge warning
ContentTwin codeowners-org-leads-not-first error
ContentTwin codeowners-no-catchall warning
ContentTwin check-suite-auto-trigger-1236702 error
ContentTwin check-suite-auto-trigger-347564 error
bmad-bgreat-suite allow_auto_merge warning
bmad-bgreat-suite delete_branch_on_merge warning
bmad-bgreat-suite check-suite-auto-trigger-1236702 error
bmad-bgreat-suite check-suite-auto-trigger-347564 error
markets allow_auto_merge warning
markets delete_branch_on_merge warning
markets codeowners-org-leads-not-first error
markets codeowners-no-catchall warning
markets check-suite-auto-trigger-1236702 error
markets check-suite-auto-trigger-347564 error
broodly allow_auto_merge warning
broodly delete_branch_on_merge warning
broodly codeowners-org-leads-not-first error
broodly codeowners-no-catchall warning
broodly check-suite-auto-trigger-1236702 error
broodly check-suite-auto-trigger-347564 error
TalkTerm allow_auto_merge warning
TalkTerm delete_branch_on_merge warning
TalkTerm codeowners-org-leads-not-first error
TalkTerm codeowners-no-catchall warning
TalkTerm check-suite-auto-trigger-1236702 error
TalkTerm check-suite-auto-trigger-347564 error
.github allow_auto_merge warning
.github delete_branch_on_merge warning
.github codeowners-org-leads-not-first error
.github codeowners-no-catchall warning
.github check-suite-auto-trigger-1236702 error
.github check-suite-auto-trigger-347564 error

Push Protection & Secret Scanning (17 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo Check Severity
.github-private security_and_analysis_unavailable warning
.github-private gitignore_secrets_block warning
google-app-scripts security_and_analysis_unavailable warning
google-app-scripts gitignore_secrets_block warning
ContentTwin security_and_analysis_unavailable warning
ContentTwin secret_scan_ci_job_present error
bmad-bgreat-suite security_and_analysis_unavailable warning
bmad-bgreat-suite secret_scan_ci_job_present error
bmad-bgreat-suite gitignore_secrets_block warning
markets security_and_analysis_unavailable warning
markets secret_scan_ci_job_present error
broodly security_and_analysis_unavailable warning
broodly secret_scan_ci_job_present error
broodly gitignore_secrets_block warning
TalkTerm security_and_analysis_unavailable warning
.github security_and_analysis_unavailable warning
.github secret_scan_ci_job_present error

Workflows (25 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo Check Severity
.github-private missing-ci.yml error
.github-private missing-pr-review-mention.yml error
.github-private codeql-default-setup-not-configured error
.github-private non-stub-claude.yml error
google-app-scripts codeql-default-setup-not-configured error
google-app-scripts stray-codeql-workflow error
google-app-scripts non-stub-dependabot-rebase.yml error
ContentTwin codeql-default-setup-not-configured error
ContentTwin stray-codeql-workflow error
ContentTwin non-stub-dependabot-rebase.yml error
bmad-bgreat-suite codeql-default-setup-not-configured error
bmad-bgreat-suite stray-codeql-workflow error
bmad-bgreat-suite non-stub-auto-rebase.yml error
markets codeql-default-setup-not-configured error
markets stray-codeql-workflow error
markets non-stub-dependabot-rebase.yml error
broodly codeql-default-setup-not-configured error
broodly stray-codeql-workflow error
broodly non-stub-dependabot-rebase.yml error
TalkTerm codeql-default-setup-not-configured error
TalkTerm non-stub-dependency-audit.yml error
TalkTerm non-stub-dependabot-automerge.yml error
TalkTerm non-stub-agent-shield.yml error
TalkTerm non-stub-feature-ideation.yml error
.github codeql-default-setup-not-configured error

Action SHA Pinning (46 finding(s))

Remediation: pin actions to SHA in each workflow file
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo Check Severity
.github-private unpinned-actions-agent-shield.yml error
.github-private unpinned-actions-auto-rebase.yml error
.github-private unpinned-actions-dependabot-automerge.yml error
.github-private unpinned-actions-dependency-audit.yml error
.github-private unpinned-actions-pr-review.yml error
.github-private unpinned-actions-repair-pr-approvals.yml error
google-app-scripts unpinned-actions-agent-shield.yml error
google-app-scripts unpinned-actions-auto-rebase.yml error
google-app-scripts unpinned-actions-claude.yml error
google-app-scripts unpinned-actions-dependabot-automerge.yml error
google-app-scripts unpinned-actions-dependency-audit.yml error
google-app-scripts unpinned-actions-feature-ideation.yml error
google-app-scripts unpinned-actions-pr-review-mention.yml error
ContentTwin unpinned-actions-agent-shield.yml error
ContentTwin unpinned-actions-auto-rebase.yml error
ContentTwin unpinned-actions-claude.yml error
ContentTwin unpinned-actions-dependabot-automerge.yml error
ContentTwin unpinned-actions-dependency-audit.yml error
ContentTwin unpinned-actions-pr-review-mention.yml error
bmad-bgreat-suite unpinned-actions-agent-shield.yml error
bmad-bgreat-suite unpinned-actions-claude.yml error
bmad-bgreat-suite unpinned-actions-dependabot-automerge.yml error
bmad-bgreat-suite unpinned-actions-dependency-audit.yml error
bmad-bgreat-suite unpinned-actions-pr-review-mention.yml error
markets unpinned-actions-agent-shield.yml error
markets unpinned-actions-auto-rebase.yml error
markets unpinned-actions-claude.yml error
markets unpinned-actions-dependabot-automerge.yml error
markets unpinned-actions-dependency-audit.yml error
markets unpinned-actions-feature-ideation.yml error
markets unpinned-actions-pr-review-mention.yml error
broodly unpinned-actions-agent-shield.yml error
broodly unpinned-actions-auto-rebase.yml error
broodly unpinned-actions-claude.yml error
broodly unpinned-actions-dependabot-automerge.yml error
broodly unpinned-actions-dependency-audit.yml error
broodly unpinned-actions-feature-ideation.yml error
broodly unpinned-actions-pr-review-mention.yml error
TalkTerm unpinned-actions-auto-rebase.yml error
TalkTerm unpinned-actions-claude.yml error
TalkTerm unpinned-actions-dependabot-rebase.yml error
TalkTerm unpinned-actions-pr-review-mention.yml error
.github unpinned-actions-agent-shield.yml error
.github unpinned-actions-claude.yml error
.github unpinned-actions-dependabot-automerge.yml error
.github unpinned-actions-dependency-audit.yml error

Dependabot Configuration (4 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: .github-private, google-app-scripts

Repo Check Severity
.github-private missing-github-actions-ecosystem error
.github-private missing-security-label warning
.github-private missing-dependencies-label warning
google-app-scripts wrong-limit-npm warning

CLAUDE.md / AGENTS.md References (1 finding(s))

Remediation: per-repo doc updates
Affected repos: .github-private

Repo Check Severity
.github-private claude-md-missing-agents-ref error

Generated by the weekly compliance audit on 2026-05-11 12:43 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

Activity

  1. don-petry
    added
    claude
    compliance-auditAutomated compliance audit finding
    on May 11, 2026

  2. don-petry commented on May 11, 2026

    @don-petry
    don-petry
    on May 11, 2026
    ContributorAuthor

    Claude finished @don-petry's task in 8m 51s —— View job • claude/issue-241-20260511-1243 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-241-20260511-1243?quick_pull=1&title=Issue%20%23241%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23241%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    Compliance Audit Fix — .github repo

    All fixes implemented and CI is green.

    Todo

    • Read AGENTS.md and relevant standards
    • Audit current state of CODEOWNERS, workflow files
    • CODEOWNERS — already compliant (* @petry-projects/org-leads); codeowners-* findings are stale
    • Add gitleaks secret-scan job to ci.yml (fixes secret_scan_ci_job_present)
    • Pin dtolnay/rust-toolchain@stable to SHA in dependency-audit.yml (fixes unpinned-actions-dependency-audit.yml)
    • Configure CodeQL default setup via GitHub API (fixes codeql-default-setup-not-configured)
    • Apply repo settings: allow_auto_merge=true, delete_branch_on_merge=true
    • Fix check-suite auto-trigger for app IDs 1236702 (Claude) and 347564 (CodeRabbit)
    • CI green — all 4 CI jobs pass (Lint, ShellCheck, Secret scan, Agent Security Scan)
    • Tagged @petry-projects/org-leads for review

    False Positives (no action taken)

    unpinned-actions-agent-shield.yml, unpinned-actions-claude.yml, unpinned-actions-dependabot-automerge.yml — internal reusable workflow refs are exempt from SHA pinning per ci-standards.md#exception-internal-reusable-workflow-references. SHA-pinning these would break Claude Code's OIDC token validation.
    | PR #243

  3. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    ContributorAuthor

    Resolved! This check is now passing as of 2026-05-12. Closing automatically.

  4. don-petry
    closed this as completedon May 12, 2026
  5. don-petry
    added a commit that references this issue on May 13, 2026

    fix(compliance): add gitleaks secret-scan job and pin rust-toolchain SHA

    d941634
  6. don-petry
    added 2 commits that reference this issue on Jun 8, 2026

    fix(compliance): 2026-05-11 audit findings for .github repo (#243)

    62516a7

    fix(compliance): 2026-05-11 audit findings for .github repo (#243)

    5ac7e48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit finding

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions