Compliance: non-stub-agent-shield.yml #1760

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   compliance-findingMachine-owned: created and auto-closed by the compliance audit. Do not hand-apply.Machine-owned: created and auto-closed by the compliance audit. Do not hand-apply.

   on Sep 11, 2026
2. don-petry commented on Sep 11, 2026

   

   don-petry

   on Sep 11, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead: No change warranted — compliance false positive (agent-modification-exempt file)

   I investigated this finding and am not making a code change. The remediation this issue requests is both a no-op and prohibited by the org standard. Details:

   1. The file is already compliant (byte-identical to the canonical template)

   The current .github/workflows/agent-shield.yml pins:

   uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable
   

   @agent-shield/v2-stable is a major-scoped channel tag (<name>/v<M>-<tier>), i.e. the canonical form. It is not a bare @agent-shield/next tier pin. I fetched standards/workflows/agent-shield.yml from petry-projects/.github and diffed it against the committed file: byte-identical. Running the prescribed gh api … | base64 -d > … remediation would rewrite the file to exactly what it already is.

   2. This file is on the "Files Agents Must Not Modify" exemption list

   petry-projects/.github/standards/agent-standards.md → Compliance Exemptions — Files Agents Must Not Modify lists:

   File	Reason
   .github/workflows/agent-shield.yml	Security boundary — agents are not permitted to weaken security scanning; changes require explicit human review

   and states verbatim: "No compliance finding will ever require a change to these files; if an existing agent-created PR touches them, close it without merging." The repo's own AGENTS.md (and the stub header: "You MUST NOT change … the uses: line") reiterate this.

   3. Conclusion

   Any agent PR editing this file would violate the org standard, AGENTS.md, and the stub header — while changing nothing. No PR should be opened for this issue.

   Recommended disposition

   • Close this issue as a false positive.
   • The non-stub-agent-shield.yml compliance check appears to (a) miss that @agent-shield/v2-stable is already the major-scoped canonical form and/or (b) not honor the workflow-exemptions.json / agent-standards.md exemption for agent-shield.yml. Recommend fixing the check in petry-projects/.github so exempt files are not flagged.
3. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Sep 13, 2026
4. don-petry commented on Sep 13, 2026

   

   don-petry

   on Sep 13, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead: No change made — compliance finding is a false positive

   Provisional note (nothing pushed). After investigating, I am not modifying
   .github/workflows/agent-shield.yml, because doing so would introduce the drift
   this audit purports to detect and would violate repo standards.

   Evidence

   1. The repo file already matches the canonical stub byte-for-byte. The remediation
      says to copy petry-projects/.github standards/workflows/agent-shield.yml verbatim.
      I fetched it and diffed:

      diff -u .github/workflows/agent-shield.yml <(gh api .../standards/workflows/agent-shield.yml | base64 -d)
      → IDENTICAL
      

   2. Both pin @agent-shield/v2-stable — a valid major-scoped channel tag
      (<name>/v<MAJOR>-<tier>, the canonical form per AGENTS.md "Release channel tags &
      the mutable-ref exception"). Confirmed the tag exists in the standards repo
      (refs/tags/agent-shield/v2-stable).

   The finding's premises are factually incorrect

   • Claim: the file uses "a bare @agent-shield/next tier pin (drift)."
     Reality: there is no @agent-shield/next reference anywhere in the file; it pins
     the major-scoped @agent-shield/v2-stable.
   • Claim: the canonical stub "delegates to …@agent-shield/v<M>-next."
     Reality: the canonical standards/workflows/agent-shield.yml delegates to
     @agent-shield/v2-stable, not a -next channel.

   Why applying the requested change would be wrong

   Switching v2-stable → v2-next would:

   • Diverge this repo from the canonical standards stub (creating real drift, opposite
     of the finding's intent);
   • Violate AGENTS.md ("Do not modify .github/workflows/agent-shield.yml — this is
     exempted from agent modification");
   • Violate the stub's own header ("You MUST NOT change … the uses: line");
   • Move the repo from the stable release channel to the pre-release next channel — a
     stability downgrade, not a compliance fix.

   Outcome

   No source files changed; no tests added (no behavioral change). The repo is already
   compliant with the canonical agent-shield.yml standard. Recommend closing this issue as
   a false positive and, if useful, tuning the non-stub-agent-shield.yml audit check so it
   recognizes major-scoped v<M>-stable channel pins as compliant.
5. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Sep 13, 2026
6. don-petry commented on Sep 13, 2026

   

   don-petry

   on Sep 13, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead Investigation — no change warranted (stale finding)

   Issue: #1760 — Compliance: non-stub-agent-shield.yml

   Summary

   After investigation, .github/workflows/agent-shield.yml is already the canonical org stub and is byte-identical to petry-projects/.github standards/workflows/agent-shield.yml. Applying the prescribed remediation (copy the canonical stub verbatim) is a no-op. No source change is warranted.

   Evidence

   • Current pin (.github/workflows/agent-shield.yml:33):
     uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-stable
     This is the major-scoped canonical channel — not the bare @agent-shield/next the finding claims.
   • Byte-identity check against the live canonical template:

     gh api repos/petry-projects/.github/contents/standards/workflows/agent-shield.yml --jq '.content' | base64 -d > /tmp/canonical.yml
     diff /tmp/canonical.yml .github/workflows/agent-shield.yml  →  BYTE_IDENTICAL
     

     The live canonical stub delegates to @agent-shield/v2-stable, not @agent-shield/v<M>-next as the issue text states.
   • Enforcing tests already green:
     • tests/dev-lead/integration/test_agent_shield_stub.py (expects @agent-shield/v2-stable) → PASS
     • CI step test-dev-lead.yml:191 runs that same validation on every PR.

   Why the requested -next repin is incorrect

   1. AGENTS.md forbids it — "Do not modify .github/workflows/agent-shield.yml — this is exempted from agent modification per standards/agent-standards.md."
   2. It would break CI — the passing stub test and the test-dev-lead.yml validation both assert @agent-shield/v2-stable.
   3. stable is the canonical tier callers pin to; next is a pre-release/dogfood tier (see AGENTS.md "Release channel tags & the mutable-ref exception"). Repinning stable → next is a regression, not remediation.
   4. This bare-tier → major-scoped migration was already completed under Compliance: non-stub-agent-shield.yml #1393, which landed v2-stable.

   Conclusion

   The finding's premise (a bare @agent-shield/next pin / a canonical stub delegating to v<M>-next) does not match the repository or the live canonical template. The stub is compliant and enforced by CI. Recommend closing #1760 as already-satisfied / false-positive. No files changed; no PR will be opened.
7. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Sep 14, 2026
8. don-petry commented on Sep 14, 2026

   

   don-petry

   on Sep 14, 2026

   CollaboratorAuthor

   More actions

   Dev-Lead: issue #1760 implementation failed — will retry

   All engines were rate-limited. This was attempt 1 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

   • Cause: rate-limited
   • Run: https://github.com/petry-projects/.github-private/actions/runs/34812724914

   Last 40 lines of engine output (redacted)

       at throwErrorIfNotOK (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:267315:24)
       at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
       at async file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:267078:7
       at async Models.generateContentStream (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:268174:16)
       at async file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:310543:19
       at async file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:287352:23
       at async retryWithBackoff (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:307380:23)
       at async GeminiChat.makeApiCallAndProcessStream (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:331230:28)
       at async GeminiChat.streamWithRetries (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:330983:29)
       at async Turn.run (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:331905:24) {
     status: 429
   }
   Attempt 10 failed: Your prepayment credits are depleted. Please go to AI Studio at https://ai.studio/projects to manage your project and billing. Learn more at https://ai.google.dev/gemini-api/docs/billing#prepay. . Max attempts reached
   Error when talking to Gemini API Full report available at: /tmp/gemini-client-error-Turn.run-sendMessageStream-2026-09-14T06-20-05-451Z.json RetryableQuotaError: Your prepayment credits are depleted. Please go to AI Studio at https://ai.studio/projects to manage your project and billing. Learn more at https://ai.google.dev/gemini-api/docs/billing#prepay. 
       at classifyGoogleError (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:306667:14)
       at retryWithBackoff (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:307403:29)
       at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
       at async GeminiChat.makeApiCallAndProcessStream (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:331230:28)
       at async GeminiChat.streamWithRetries (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:330983:29)
       at async Turn.run (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:331905:24)
       at async GeminiClient.processTurn (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:345566:22)
       at async GeminiClient.sendMessageStream (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/chunk-YSBB75DZ.js:345663:14)
       at async file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/gemini-OENNDR6N.js:11773:26
       at async main (file:///home/runner/.npm-global/lib/node_modules/@google/gemini-cli/bundle/gemini-OENNDR6N.js:17200:5) {
     cause: {
       code: 429,
       message: 'Your prepayment credits are depleted. Please go to AI Studio at https://ai.studio/projects to manage your project and billing. Learn more at https://ai.google.dev/gemini-api/docs/billing#prepay. ',
       details: []
     },
     retryDelayMs: undefined,
     status: 429
   }
   {
     "session_id": "49a131f9-43c9-4b95-a27e-2a888bafb0d9",
     "error": {
       "type": "Error",
       "message": "Your prepayment credits are depleted. Please go to AI Studio at https://ai.studio/projects to manage your project and billing. Learn more at https://ai.google.dev/gemini-api/docs/billing#prepay. ",
       "code": 429
     }
   }
   
   
9. 292 remaining items

   Load more

   Load more actions
10. don-petry

    added

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    and removed

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    on Oct 13, 2026
11. don-petry commented on Oct 16, 2026

    

    don-petry

    on Oct 16, 2026

    CollaboratorAuthor

    More actions

    Weekly Compliance Audit (2026-10-16)

    This finding is still open.

    Detail: Centralized workflow agent-shield.yml references the reusable but is not pinned to the major-scoped channel @agent-shield/v2-next (org standard — a bare @agent-shield/next tier pin is drift). Replace with the canonical stub from standards/workflows/agent-shield.yml which delegates to combsmith/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/v2-next.

    Standard: standards/ci-standards.md#centralization-tiers