Compliance audit — 2026-08-21

Compliance Audit — 2026-08-21

This umbrella issue tracks all findings from the automated compliance audit run on 2026-08-21.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 47 across 8 repositories

Remediation Work Breakdown

Repository Settings (5 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: demo-repository

Repo	Check	Severity
`demo-repository`	`allow_auto_merge`	`warning`
`demo-repository`	`delete_branch_on_merge`	`warning`
`demo-repository`	`has_discussions`	`error`
`demo-repository`	`missing-codeowners`	`error`
`demo-repository`	`check-suite-prefs-unreadable`	`warning`

Push Protection & Secret Scanning (5 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: demo-repository, markets, repo-template

Repo	Check	Severity
`repo-template`	`gitignore_baseline`	`error`
`markets`	`gitignore_baseline`	`error`
`demo-repository`	`security_and_analysis_unavailable`	`warning`
`demo-repository`	`secret_scan_ci_job_present`	`error`
`demo-repository`	`gitignore_baseline`	`error`

Repository Rulesets (15 finding(s))

Remediation: apply-rulesets.sh
Affected repos: TalkTerm, bmad-bgreat-suite, broodly, demo-repository, google-app-scripts, markets

Repo	Check	Severity
`TalkTerm`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`TalkTerm`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`markets`	`ruleset-bypass-orgadmin-code-quality`	`error`
`markets`	`ruleset-bypass-dependabot-code-quality`	`error`
`markets`	`ruleset-drift-pr-quality-require_code_owner_review`	`error`
`markets`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`markets`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`bmad-bgreat-suite`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`google-app-scripts`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`broodly`	`ruleset-drift-pr-quality-require_code_owner_review`	`error`
`broodly`	`ruleset-drift-pr-quality-dismiss_stale_reviews_on_push`	`error`
`broodly`	`ruleset-drift-pr-quality-require_last_push_approval`	`error`
`demo-repository`	`missing-pr-quality`	`error`
`demo-repository`	`missing-code-quality`	`error`

Workflows (15 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, broodly, demo-repository

Repo	Check	Severity
`.github-private`	`non-stub-agent-shield.yml`	`error`
`broodly`	`dev-lead-stub-pin`	`error`
`broodly`	`dev-lead-stub-agent-ref`	`error`
`demo-repository`	`missing-ci.yml`	`error`
`demo-repository`	`missing-sonarcloud.yml`	`error`
`demo-repository`	`missing-dev-lead.yml`	`error`
`demo-repository`	`missing-dependabot-automerge.yml`	`error`
`demo-repository`	`missing-dependency-audit.yml`	`error`
`demo-repository`	`missing-agent-shield.yml`	`error`
`demo-repository`	`missing-pr-review-mention.yml`	`error`
`demo-repository`	`missing-feature-ideation.yml`	`error`
`demo-repository`	`missing-pr-auto-review.yml`	`error`
`demo-repository`	`missing-initiative-driver.yml`	`error`
`demo-repository`	`missing-permissions-auto-assign.yml`	`warning`
`demo-repository`	`missing-permissions-proof-html.yml`	`warning`

Action SHA Pinning (2 finding(s))

Remediation: pin actions to SHA in each workflow file
Affected repos: demo-repository

Repo	Check	Severity
`demo-repository`	`unpinned-actions-auto-assign.yml`	`error`
`demo-repository`	`unpinned-actions-proof-html.yml`	`error`

Dependabot Configuration (1 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: demo-repository

Repo	Check	Severity
`demo-repository`	`missing-config`	`error`

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (4 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: demo-repository

Repo	Check	Severity
`demo-repository`	`missing-claude-md`	`error`
`demo-repository`	`missing-agents-md`	`error`
`demo-repository`	`missing-copilot-setup-steps`	`warning`
`demo-repository`	`missing-copilot-instructions`	`error`

Generated by the weekly compliance audit on 2026-08-21 13:10 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

Dev-Lead: issue #1004 implementation failed — will retry

The engine failed (engine-error — e.g. a timeout or transient engine error). This was attempt 1 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

Cause: engine-error
Run: https://github.com/petry-projects/.github/actions/runs/32642361801

Last 40 lines of engine output (redacted)

    [copilot] calling gh copilot (model=openai/o4-mini, timeout=2100s, flags=--yolo)
Error: Classic Personal Access Tokens (ghp_) are not supported by Copilot.

The GH_TOKEN environment variable contains a classic PAT.
Please use a Fine-Grained Personal Access Token or another authentication method.

To fix this, you can:
  • Replace the token in GH_TOKEN with a fine-grained PAT
  • Unset GH_TOKEN and run 'gh auth login' to authenticate
  • Unset GH_TOKEN and start 'copilot', then use the '/login' command

Dev-Lead: issue #1004 implementation failed — will retry

The engine failed (engine-error — e.g. a timeout or transient engine error). This was attempt 2 of 3; dev-lead will retry automatically. You can also re-apply the dev-lead label to retry now.

Cause: engine-error
Run: https://github.com/petry-projects/.github/actions/runs/32644901760

Last 40 lines of engine output (redacted)

    [copilot] calling gh copilot (model=openai/o4-mini, timeout=2100s, flags=--yolo)
Error: Classic Personal Access Tokens (ghp_) are not supported by Copilot.

The GH_TOKEN environment variable contains a classic PAT.
Please use a Fine-Grained Personal Access Token or another authentication method.

To fix this, you can:
  • Replace the token in GH_TOKEN with a fine-grained PAT
  • Unset GH_TOKEN and run 'gh auth login' to authenticate
  • Unset GH_TOKEN and start 'copilot', then use the '/login' command

Resolved! This check is now passing as of 2026-08-28. Closing automatically.

Navigation Menu

Repository navigation

Compliance audit — 2026-08-21 #1004