Skip to content

Compliance: non-stub-dependabot-automerge.yml #140

Closed
#514
Closed
Compliance: non-stub-dependabot-automerge.yml#140
#514
Labels
compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

Description

@don-petry
don-petry
opened on May 12, 2026

Compliance Finding

Category: ci-workflows
Severity: error
Check: non-stub-dependabot-automerge.yml

Detail

Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

Standard Reference

standards/ci-standards.md#centralization-tiers

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    claude
    compliance-auditAutomated compliance audit finding
    on May 12, 2026

  2. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Claude encountered an error —— View job

    I'll analyze this and get back to you.

  3. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  4. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  5. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  6. don-petry commented on May 12, 2026

    @don-petry
    don-petry
    on May 12, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-12)

    This finding is still open.

    Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  7. don-petry commented on May 13, 2026

    @don-petry
    don-petry
    on May 13, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-13)

    This finding is still open.

    Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  8. don-petry commented on May 15, 2026

    @don-petry
    don-petry
    on May 15, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-05-15)

    This finding is still open.

    Detail: Centralized workflow dependabot-automerge.yml references the reusable but is not pinned to @v1 (org standard). Replace with the canonical stub from standards/workflows/dependabot-automerge.yml which delegates to petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1.

    Standard: standards/ci-standards.md#centralization-tiers

  9. don-petry
    added
    claude
    and removed
    claude
    on May 20, 2026

  10. 28 remaining items

  11. don-petry
    added
    dev-leadFor dev-lead agent pickup
    and removed
    dev-leadFor dev-lead agent pickup
    on Jun 9, 2026

  12. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    CollaboratorAuthor

    Dev-Lead Implementation Plan

    Issue: #140 — Compliance: non-stub-dependabot-automerge.yml

    Scope

    Replace the SHA-pinned reusable reference in .github/workflows/dependabot-automerge.yml with the org-standard @v1 tag, matching the canonical stub verbatim.

    Implementation Checklist

    • .github/workflows/dependabot-automerge.yml — change uses: ref from @<SHA> # v1 to @v1

    Tests to Write

    • N/A — TDD exception applies. This is a pure behavior-preserving configuration compliance fix (SHA and @v1 tag both resolve to the same reusable workflow version). The compliance audit that generated this issue is the regression guard.

    Test Command

    bash scripts/dev-lead-lint.sh

  13. don-petry commented on Jun 9, 2026

    @don-petry
    don-petry
    on Jun 9, 2026
    CollaboratorAuthor

    Dev-Lead: Implementation Complete

    Plan Execution

    • .github/workflows/dependabot-automerge.yml — replaced SHA-pinned reusable ref with @v1

    Test Results

      [lint] shellcheck on 40 file(s)...
  [lint] validating 4 agent profile(s)...
OK: agents/agentic-workflows.md
OK: agents/compliance-auditor.md
OK: agents/feature-ideator.md
OK: agents/pr-reviewer.md
  [lint] all checks passed

    Files Changed

    • .github/workflows/dependabot-automerge.yml: replaced @761dd4a1a484a239429ed15d44d068de04fe2ee1 # v1 with @v1 on the uses: line — the file now matches the canonical stub from standards/workflows/dependabot-automerge.yml verbatim

    Notes

    TDD exception applied: this is a behavior-preserving configuration compliance fix. Both the SHA and the @v1 tag refer to the same reusable workflow version; only the reference format changes. The org-level compliance audit is the regression guard for stub drift.

  14. don-petry
    closed this as completedin #514on Jun 10, 2026
  15. don-petry
    added 10 commits that reference this issue on Jun 10, 2026

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    0f4d894

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    bf57274

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    d449181

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    d706027

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    528a091

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    feedeb4

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    32210e7

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    ba5643b

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    e0ab3c5

    feat: implement issue #140 — Compliance: non-stub-dependabot-automerg…

    910323b
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit findingdev-leadFor dev-lead agent pickup

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions