Repository navigation

Compliance: missing-code-quality #46

Closed

Labels

compliance-audit

opened

Compliance Finding

Category: rulesets
Severity: error
Check: missing-code-quality

Detail

Missing code-quality repository ruleset (required status checks)

Standard Reference

standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

don-petry
added
compliance-auditAutomated compliance audit finding

claude
on Apr 5, 2026
claude commented on Apr 5, 2026
claudeBot
on Apr 5, 2026 – with Claude
Claude Code is working…

I'll analyze this and get back to you.

View job run
don-petry commented on Apr 6, 2026
don-petry
on Apr 6, 2026
ContributorAuthor
Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing code-quality repository ruleset (required status checks)

Standard: standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories
don-petry commented on Apr 6, 2026
don-petry
on Apr 6, 2026
ContributorAuthor
Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing code-quality repository ruleset (required status checks)

Standard: standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories
don-petry commented on Apr 6, 2026
don-petry
on Apr 6, 2026
ContributorAuthor
Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing code-quality repository ruleset (required status checks)

Standard: standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories
don-petry commented on Apr 6, 2026
don-petry
on Apr 6, 2026
ContributorAuthor
Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing code-quality repository ruleset (required status checks)

Standard: standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories
don-petry commented on Apr 6, 2026
don-petry
on Apr 6, 2026
ContributorAuthor
Weekly Compliance Audit (2026-04-06)

This finding is still open.

Detail: Missing code-quality repository ruleset (required status checks)

Standard: standards/github-settings.md#code-quality--required-checks-ruleset-all-repositories
don-petry
added
claude
and removed
claude
on Apr 6, 2026
don-petry commented on Apr 6, 2026
don-petry
on Apr 6, 2026
ContributorAuthor
Claude encountered an error —— View job • claude/issue-46-20260406-1856 • [Create PR ➔](https://github.com/petry-projects/TalkTerm/compare/main...claude/issue-46-20260406-1856?quick_pull=1&title=Issue%20%2346%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2346%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Working on compliance fix

Gather context (existing workflows, project structure)

Create .github/workflows/code-quality.yml CI workflow with required quality check jobs

Create the code-quality repository ruleset via GitHub API requiring those status checks

Commit and push changes

Create PR

Analysis: The repository is missing a code-quality GitHub ruleset that enforces required status checks on PRs to main. The fix requires:

A CI workflow providing the status checks (lint, typecheck, format, test)

A repository ruleset via GitHub API that requires those checks to pass
github-actions
added a commit that references this issue on Apr 6, 2026
ci: add code-quality workflow with required status check jobs
e378b3c
don-petry
added
claude
and removed
claude
on Apr 7, 2026

ContributorAuthor

Claude finished @don-petry's task in 12m 0s —— View job

Compliance fix: manual steps required

Gather context (standards doc, existing workflows, project structure)
Determine required status checks for code-quality ruleset
Create code-quality workflow definition and setup script (committed locally)
Push changes — blocked (see constraints below)
Create code-quality repository ruleset — blocked (see constraints below)

Why automated fix failed

Two hard constraints prevent the automated fix:

1. Workflow file push requires workflows: write

The local branch contains commit c6e4e1c (not yet on origin/main) which modified .github/workflows/feature-ideation.yml. GitHub rejects any push from a GitHub App token that touches workflow files without workflows: write. The branch cannot be pushed until this constraint is resolved.

2. Repository ruleset creation requires administration: write

Creating a GitHub ruleset requires calling POST /repos/{owner}/{repo}/rulesets with a token that has administration: write. The current claude.yml workflow permissions block:

permissions:
  contents: write
  pull-requests: write
  issues: write
  actions: read
  checks: read
  # Missing: administration: write, workflows: write

Manual fix steps

Step 1 — Create the CI workflow (requires pushing a workflow file)

Create .github/workflows/code-quality.yml with this content:

name: Code Quality

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  typecheck:
    name: Type check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm run typecheck

  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm run lint

  format:
    name: Format check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm run format -- --check

  test:
    name: Tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: '24'
          cache: 'npm'
      - run: npm ci
      - run: npm run test -- --coverage

Step 2 — Create the code-quality ruleset (run locally with your PAT or a token with administration:write):

gh api repos/petry-projects/TalkTerm/rulesets \
  --method POST \
  --header "Accept: application/vnd.github+json" \
  --header "X-GitHub-Api-Version: 2022-11-28" \
  --field name='code-quality' \
  --field target='branch' \
  --field enforcement='active' \
  --field 'conditions[ref_name][include][]=~DEFAULT_BRANCH' \
  --field 'conditions[ref_name][exclude][]=' \
  --input - <<'EOF'
{
  "name": "code-quality",
  "target": "branch",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "include": ["~DEFAULT_BRANCH"],
      "exclude": []
    }
  },
  "rules": [
    {
      "type": "required_status_checks",
      "parameters": {
        "required_status_checks": [
          { "context": "Type check" },
          { "context": "Lint" },
          { "context": "Format check" },
          { "context": "Tests" }
        ],
        "strict_required_status_checks_policy": false
      }
    },
    { "type": "deletion" },
    { "type": "non_fast_forward" }
  ]
}
EOF

Step 3 — Enable Claude to fix this automatically in future runs

Add administration: write and workflows: write to .github/workflows/claude.yml:

permissions:
  contents: write
  id-token: write
  pull-requests: write
  issues: write
  actions: read
  checks: read
  administration: write   # needed: create/update rulesets
  workflows: write        # needed: push workflow files

Note: The standard may specify different required check names — verify against the standard before creating the ruleset. The job names above follow AGENTS.md §7 CI quality gates.

don-petry
added
claude
and removed
claude
on Apr 7, 2026
don-petry commented on Apr 7, 2026
don-petry
on Apr 7, 2026
ContributorAuthor
Claude finished @don-petry's task in 3m 35s —— View job • claude/issue-46-20260407-1733 • [Create PR ➔](https://github.com/petry-projects/TalkTerm/compare/main...claude/issue-46-20260407-1733?quick_pull=1&title=Issue%20%2346%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2346%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Compliance fix complete (partial automation)

Gather context (previous attempts, standards reference, blockers)

Create .github/workflows/code-quality.yml CI workflow

Self-review: fixed format check command (npx prettier --check . instead of conflicting npm run format -- --check)

Commit and push workflow file

Create PR — petry-projects/TalkTerm#73

Tag code owners for review (@don-petry)

Create code-quality repository ruleset — manual step required (see below)

What was automated

The code-quality.yml workflow was created and pushed. It provides the four required status check jobs:

Job Status check context

typecheck Type check

lint Lint

format Format check

test Tests

PR: petry-projects/TalkTerm#73

Manual step required after merging

Creating the repository ruleset requires administration: write, which is not granted to the Claude GitHub App. Run this with your PAT after the PR is merged:

gh api repos/petry-projects/TalkTerm/rulesets --method POST \ --header "Accept: application/vnd.github+json" \ --header "X-GitHub-Api-Version: 2022-11-28" \ --input - <<'EOF' { "name": "code-quality", "target": "branch", "enforcement": "active", "conditions": { "ref_name": { "include": ["~DEFAULT_BRANCH"], "exclude": [] } }, "rules": [ { "type": "required_status_checks", "parameters": { "required_status_checks": [ { "context": "Type check" }, { "context": "Lint" }, { "context": "Format check" }, { "context": "Tests" } ], "strict_required_status_checks_policy": false } }, { "type": "deletion" }, { "type": "non_fast_forward" } ] } EOF

Or via Settings → Rules → Rulesets → New branch ruleset named code-quality, targeting the default branch, requiring those four status checks.

To enable full automation in future

Add administration: write to the job permissions in .github/workflows/claude.yml:

permissions: contents: write id-token: write pull-requests: write issues: write actions: read checks: read administration: write # needed: create/update rulesets

| Branch
don-petry
added a commit that references this issue on Apr 7, 2026
ci: add code-quality workflow with required status checks
ff3bd21
don-petry
added
claude
and removed
claude
on Apr 8, 2026

ContributorAuthor

Claude finished @don-petry's task in 4m 30s —— View job • claude/issue-46-20260408-2243 • [Create PR ➔](https://github.com/petry-projects/TalkTerm/compare/main...claude/issue-46-20260408-2243?quick_pull=1&title=Issue%20%2346%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%2346%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Compliance fix complete

Gather context (PR ci: add code-quality workflow for required status checks #73 was closed unmerged; no ci.yml existed; early-stage repo with no package.json)
Check for workflow template in org standards (none for ci.yml — Tier 2 per-repo)
Create ci.yml CI workflow with required status check jobs (Lint, Format check, Type check, Tests)
Self-review: fixed format check command — npx prettier --check . instead of conflicting npm run format -- --check
Create code-quality repository ruleset via GitHub API — success (ruleset ID 14847016, active)
Commit and push changes
Create PR — petry-projects/TalkTerm#84
Tag code owner @don-petry for review

What was automated

Repository ruleset created — code-quality (ID 14847016) is now active on main, requiring all 8 checks:

Check	Source
`SonarCloud`	`sonarcloud.yml`
`Analyze (javascript-typescript)`	`codeql.yml`
`Analyze (actions)`	`codeql.yml`
`claude`	`claude.yml`
`Lint`	`ci.yml` (this PR)
`Format check`	`ci.yml` (this PR)
`Type check`	`ci.yml` (this PR)
`Tests`	`ci.yml` (this PR)

Note on CI: The 4 CI jobs will fail until package.json and source code are added to the repo — this is expected for an early-stage project. The workflow structure is correct.
• Branch

don-petry
added a commit that references this issue on Apr 8, 2026
ci: add CI workflow providing code-quality required status checks
be2c33f
don-petry commented on Apr 9, 2026
don-petry
on Apr 9, 2026
ContributorAuthor
Resolved! This check is now passing as of 2026-04-09. Closing automatically.
don-petry
closed this as completed on Apr 9, 2026

to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

Labels

compliance-audit

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests