Skip to content

Compliance: non-stub-auto-rebase.yml #139

Closed
#515
Closed
Compliance: non-stub-auto-rebase.yml#139
#515
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on May 12, 2026

Compliance Finding

Category: ci-workflows
Severity: error
Check: non-stub-auto-rebase.yml

Detail

Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    claude
    compliance-auditAutomated compliance audit finding
    on May 12, 2026

  2. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  3. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  4. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  5. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  6. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  7. don-petry commented on May 13, 2026

    @don-petry
    don-petry
    on May 13, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-13)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  8. don-petry commented on May 15, 2026

    @don-petry
    don-petry
    on May 15, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-15)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  9. don-petry
    added
    claude
    and removed
    claude
    on May 20, 2026

  10. 25 remaining items

  11. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jun 9, 2026

  12. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    CollaboratorAuthor
    All engines are currently rate-limited. Please re-apply the `dev-lead` label when the rate limit clears to retry.
  13. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jun 9, 2026

  14. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #139 — Compliance: non-stub-auto-rebase.yml

    Scope

    Replace the SHA-pinned uses: reference in .github/workflows/auto-rebase.yml with the org-standard @v1 tag to match the canonical stub in standards/workflows/auto-rebase.yml.

    Root Cause

    .github/workflows/auto-rebase.yml currently calls the reusable with a SHA (@761dd4a1a484a239429ed15d44d068de04fe2ee1 # v1) instead of the @v1 version tag. AGENTS.md §"Release channel tags & the mutable-ref exception" explicitly exempts first-party reusable workflows from the SHA-pin standard and requires @v1-style versioned tags instead.

    Implementation Checklist

    • tests/dev-lead/integration/test_auto_rebase_stub.py — new Python test validating auto-rebase.yml uses @v1 (not a SHA)
    • .github/workflows/test-dev-lead.yml — add auto-rebase-stub job to run the new test; add .github/workflows/auto-rebase.yml to path triggers
    • .github/workflows/auto-rebase.yml — change @761dd4a1a484a239429ed15d44d068de04fe2ee1 # v1 → @v1

    Tests to Write

    • tests/dev-lead/integration/test_auto_rebase_stub.py — asserts auto-rebase.yml references the reusable with @v1, not a raw SHA

    Test Command

    python3 tests/dev-lead/integration/test_auto_rebase_stub.py

  15. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    CollaboratorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • Wrote tests/dev-lead/integration/test_auto_rebase_stub.py — validates auto-rebase.yml uses @v1, not a SHA
    • Confirmed test failed against the SHA-pinned original (TDD red phase)
    • Added auto-rebase-stub job to test-dev-lead.yml CI; added .github/workflows/auto-rebase.yml to path triggers
    • Fixed .github/workflows/auto-rebase.yml: replaced @761dd4a1a484a239429ed15d44d068de04fe2ee1 # v1 → @v1
    • Confirmed test passes against the fixed file (TDD green phase)
    • bash scripts/dev-lead-lint.sh — all checks passed

    Test Results

    PASS: .github/workflows/auto-rebase.yml correctly references petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1

  [lint] shellcheck on 40 file(s)...
  [lint] validating 4 agent profile(s)...
OK: agents/agentic-workflows.md
OK: agents/compliance-auditor.md
OK: agents/feature-ideator.md
OK: agents/pr-reviewer.md
  [lint] all checks passed

    Files Changed

    • .github/workflows/auto-rebase.yml: changed uses: ref from SHA @761dd4a1a484a239429ed15d44d068de04fe2ee1 # v1 to @v1 — now matches canonical stub exactly
    • .github/workflows/test-dev-lead.yml: added auto-rebase-stub CI job; added auto-rebase.yml to path triggers for both pull_request and push
    • tests/dev-lead/integration/test_auto_rebase_stub.py: new regression guard — fails if auto-rebase.yml ever drifts back to a SHA-pinned ref

    Notes

    The change is behavior-preserving: @v1 and the SHA both pointed to the same commit. The compliance finding was purely about the ref format: AGENTS.md §"Release channel tags & the mutable-ref exception" exempts first-party reusable workflows from the SHA-pin standard and requires versioned tags (@v1). The new test guards against future regressions of the same kind.

  16. don-petry
    added a commit that references this issue on Jun 10, 2026

    feat: implement issue #139 — Compliance: non-stub-auto-rebase.yml

    2a2783e

  17. don-petry commented on Jun 10, 2026

    @don-petry
    don-petry
    on Jun 10, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-06-10)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  18. don-petry
    added a commit that references this issue on Jun 10, 2026

    feat: implement issue #139 — Compliance: non-stub-auto-rebase.yml

    a076a61

  19. don-petry commented on Jun 12, 2026

    @don-petry
    don-petry
    on Jun 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-06-12)

    This finding is still open.

    Detail: Centralized workflow auto-rebase.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/auto-rebase.yml which delegates to petry-projects/.github/.github/workflows/auto-rebase-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  20. don-petry
    added a commit that references this issue on Jun 13, 2026

    feat: implement issue #139 — Compliance: non-stub-auto-rebase.yml (#515)

    1a037b9
  21. don-petry
    closed this as completedin #515on Jun 13, 2026
  22. don-petry
    added 2 commits that reference this issue on Jun 14, 2026

    feat: implement issue #139 — Compliance: non-stub-auto-rebase.yml (#515)

    deed5a1

    feat: implement issue #139 — Compliance: non-stub-auto-rebase.yml (#515)

    736164d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions