Compliance audit — 2026-05-29

Compliance Audit — 2026-05-29

This umbrella issue tracks all findings from the automated compliance audit run on 2026-05-29.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 115 across 8 repositories

Remediation Work Breakdown

Repository Settings (26 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
`.github-private`	`codeowners-org-leads-not-first`	`error`
`.github-private`	`codeowners-no-catchall`	`warning`
`.github-private`	`check-suite-auto-trigger-1236702`	`error`
`.github-private`	`check-suite-auto-trigger-347564`	`error`
`markets`	`check-suite-auto-trigger-1236702`	`error`
`markets`	`check-suite-auto-trigger-347564`	`error`
`.github`	`codeowners-org-leads-not-first`	`error`
`.github`	`codeowners-no-catchall`	`warning`
`.github`	`check-suite-auto-trigger-1236702`	`error`
`.github`	`check-suite-auto-trigger-347564`	`error`
`broodly`	`codeowners-org-leads-not-first`	`error`
`broodly`	`codeowners-no-catchall`	`warning`
`broodly`	`check-suite-auto-trigger-1236702`	`error`
`broodly`	`check-suite-auto-trigger-347564`	`error`
`google-app-scripts`	`check-suite-auto-trigger-1236702`	`error`
`google-app-scripts`	`check-suite-auto-trigger-347564`	`error`
`bmad-bgreat-suite`	`check-suite-auto-trigger-1236702`	`error`
`bmad-bgreat-suite`	`check-suite-auto-trigger-347564`	`error`
`TalkTerm`	`codeowners-org-leads-not-first`	`error`
`TalkTerm`	`codeowners-no-catchall`	`warning`
`TalkTerm`	`check-suite-auto-trigger-1236702`	`error`
`TalkTerm`	`check-suite-auto-trigger-347564`	`error`
`ContentTwin`	`codeowners-org-leads-not-first`	`error`
`ContentTwin`	`codeowners-no-catchall`	`warning`
`ContentTwin`	`check-suite-auto-trigger-1236702`	`error`
`ContentTwin`	`check-suite-auto-trigger-347564`	`error`

Push Protection & Secret Scanning (17 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
`.github-private`	`secret_scanning_ai_detection`	`warning`
`.github-private`	`secret_scanning_non_provider_patterns`	`warning`
`markets`	`secret_scanning_ai_detection`	`warning`
`markets`	`secret_scanning_non_provider_patterns`	`warning`
`.github`	`secret_scanning_ai_detection`	`warning`
`.github`	`secret_scanning_non_provider_patterns`	`warning`
`broodly`	`secret_scanning_ai_detection`	`warning`
`broodly`	`secret_scanning_non_provider_patterns`	`warning`
`google-app-scripts`	`secret_scanning_ai_detection`	`warning`
`google-app-scripts`	`secret_scanning_non_provider_patterns`	`warning`
`bmad-bgreat-suite`	`secret_scanning_ai_detection`	`warning`
`bmad-bgreat-suite`	`secret_scanning_non_provider_patterns`	`warning`
`TalkTerm`	`secret_scanning_ai_detection`	`warning`
`TalkTerm`	`secret_scanning_non_provider_patterns`	`warning`
`ContentTwin`	`secret_scanning_ai_detection`	`warning`
`ContentTwin`	`secret_scanning_non_provider_patterns`	`warning`
`ContentTwin`	`gitignore_secrets_block`	`warning`

Workflows (47 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
`.github-private`	`missing-permissions-issue-triage-runner.yml`	`warning`
`.github-private`	`ci-concurrency-missing-sha`	`warning`
`.github-private`	`non-stub-dev-lead.yml`	`error`
`.github-private`	`non-stub-auto-rebase.yml`	`error`
`.github-private`	`non-stub-dependency-audit.yml`	`error`
`.github-private`	`non-stub-dependabot-automerge.yml`	`error`
`.github-private`	`non-stub-agent-shield.yml`	`error`
`markets`	`non-stub-dev-lead.yml`	`error`
`markets`	`non-stub-auto-rebase.yml`	`error`
`markets`	`non-stub-dependency-audit.yml`	`error`
`markets`	`non-stub-dependabot-automerge.yml`	`error`
`markets`	`non-stub-dependabot-rebase.yml`	`error`
`markets`	`non-stub-agent-shield.yml`	`error`
`markets`	`non-stub-feature-ideation.yml`	`error`
`markets`	`non-stub-pr-review-mention.yml`	`error`
`broodly`	`non-stub-dev-lead.yml`	`error`
`broodly`	`non-stub-auto-rebase.yml`	`error`
`broodly`	`non-stub-dependency-audit.yml`	`error`
`broodly`	`non-stub-dependabot-automerge.yml`	`error`
`broodly`	`non-stub-dependabot-rebase.yml`	`error`
`broodly`	`non-stub-agent-shield.yml`	`error`
`broodly`	`non-stub-feature-ideation.yml`	`error`
`broodly`	`non-stub-pr-review-mention.yml`	`error`
`google-app-scripts`	`non-stub-dev-lead.yml`	`error`
`google-app-scripts`	`non-stub-auto-rebase.yml`	`error`
`google-app-scripts`	`non-stub-dependency-audit.yml`	`error`
`google-app-scripts`	`non-stub-dependabot-automerge.yml`	`error`
`google-app-scripts`	`non-stub-dependabot-rebase.yml`	`error`
`google-app-scripts`	`non-stub-agent-shield.yml`	`error`
`google-app-scripts`	`non-stub-feature-ideation.yml`	`error`
`google-app-scripts`	`non-stub-pr-review-mention.yml`	`error`
`bmad-bgreat-suite`	`non-stub-dev-lead.yml`	`error`
`bmad-bgreat-suite`	`non-stub-dependency-audit.yml`	`error`
`bmad-bgreat-suite`	`non-stub-dependabot-automerge.yml`	`error`
`bmad-bgreat-suite`	`non-stub-dependabot-rebase.yml`	`error`
`bmad-bgreat-suite`	`non-stub-agent-shield.yml`	`error`
`bmad-bgreat-suite`	`non-stub-pr-review-mention.yml`	`error`
`TalkTerm`	`non-stub-dev-lead.yml`	`error`
`TalkTerm`	`non-stub-auto-rebase.yml`	`error`
`TalkTerm`	`non-stub-dependabot-rebase.yml`	`error`
`TalkTerm`	`non-stub-feature-ideation.yml`	`error`
`ContentTwin`	`non-stub-dev-lead.yml`	`error`
`ContentTwin`	`non-stub-auto-rebase.yml`	`error`
`ContentTwin`	`non-stub-dependency-audit.yml`	`error`
`ContentTwin`	`non-stub-dependabot-automerge.yml`	`error`
`ContentTwin`	`non-stub-dependabot-rebase.yml`	`error`
`ContentTwin`	`non-stub-agent-shield.yml`	`error`

Action SHA Pinning (3 finding(s))

Remediation: pin actions to SHA in each workflow file
Affected repos: .github-private

Repo	Check	Severity
`.github-private`	`unpinned-actions-daily-pr-review-health.yml`	`error`
`.github-private`	`unpinned-actions-repair-pr-approvals.yml`	`error`
`.github-private`	`unpinned-actions-test.yml`	`error`

Dependabot Configuration (3 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: .github-private

Repo	Check	Severity
`.github-private`	`missing-github-actions-ecosystem`	`error`
`.github-private`	`missing-security-label`	`warning`
`.github-private`	`missing-dependencies-label`	`warning`

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (19 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: .github, .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
`.github-private`	`claude-md-missing-agents-ref`	`error`
`.github-private`	`copilot-setup-steps-invalid-job-name`	`error`
`markets`	`copilot-setup-steps-invalid-job-name`	`error`
`.github`	`copilot-setup-steps-invalid-job-name`	`error`
`broodly`	`copilot-setup-steps-invalid-job-name`	`error`
`broodly`	`copilot-instructions-missing-tech-stack`	`warning`
`broodly`	`copilot-instructions-missing-local-dev-commands`	`warning`
`google-app-scripts`	`copilot-setup-steps-invalid-job-name`	`error`
`google-app-scripts`	`copilot-instructions-missing-tech-stack`	`warning`
`google-app-scripts`	`copilot-instructions-missing-local-dev-commands`	`warning`
`bmad-bgreat-suite`	`copilot-setup-steps-invalid-job-name`	`error`
`bmad-bgreat-suite`	`copilot-instructions-missing-tech-stack`	`warning`
`bmad-bgreat-suite`	`copilot-instructions-missing-local-dev-commands`	`warning`
`TalkTerm`	`copilot-setup-steps-invalid-job-name`	`error`
`TalkTerm`	`copilot-instructions-missing-tech-stack`	`warning`
`TalkTerm`	`copilot-instructions-missing-local-dev-commands`	`warning`
`ContentTwin`	`copilot-setup-steps-invalid-job-name`	`error`
`ContentTwin`	`copilot-instructions-missing-tech-stack`	`warning`
`ContentTwin`	`copilot-instructions-missing-local-dev-commands`	`warning`

Generated by the weekly compliance audit on 2026-05-29 15:58 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

Dev-Lead Implementation Plan

Issue: #375 — Compliance audit — 2026-05-29

Scope

Fix compliance findings for the petry-projects/.github repository: create the missing copilot-setup-steps.yml workflow with the required job name, and apply GitHub API settings (check-suite auto-trigger, secret scanning) where feasible with available token permissions.

Findings for `.github` repo

Finding	Type	Action
`codeowners-org-leads-not-first`	File	Already correct — `* @petry-projects/org-leads` in `.github/CODEOWNERS`; stale finding
`codeowners-no-catchall`	File	Already correct — catch-all `*` present; stale finding
`check-suite-auto-trigger-1236702`	API	Run `fix-check-suite-prefs.sh` (requires classic PAT)
`check-suite-auto-trigger-347564`	API	Run `fix-check-suite-prefs.sh` (requires classic PAT)
`secret_scanning_ai_detection`	API	Run `apply-repo-settings.sh` (requires admin token)
`secret_scanning_non_provider_patterns`	API	Run `apply-repo-settings.sh` (requires admin token)
`copilot-setup-steps-invalid-job-name`	File	Create `.github/workflows/copilot-setup-steps.yml` with correct job name

Implementation Checklist

Create .github/workflows/copilot-setup-steps.yml copied verbatim from standards/workflows/copilot-setup-steps.yml (with shell-only stack block active, since this repo uses only bash/shell scripts)
Verify the workflow passes yamllint
Verify the workflow passes actionlint
Attempt API fix for check-suite-auto-trigger settings (note: may fail if token lacks classic PAT scope)
Attempt API fix for secret_scanning settings (note: may fail if token lacks admin scope)

Tests to Write / Verify

Phase 2 Exception: This is a pure configuration/workflow addition with no observable behavioral logic change — no unit tests are applicable. Validation is via linting only (yamllint + actionlint), consistent with how all other workflow additions are verified in this repo.

yamllint passes on .github/workflows/copilot-setup-steps.yml
actionlint passes on .github/workflows/copilot-setup-steps.yml

Test Command

pip install --quiet yamllint && yamllint -c <(cat <<'YAMLLINTRC'
extends: default
rules:
  line-length:
    max: 200
  truthy:
    check-keys: false
  document-start: disable
  comments:
    min-spaces-from-content: 1
YAMLLINTRC
) .github/workflows/copilot-setup-steps.yml

Dev-Lead: Implementation Complete

Plan Execution

Analyzed CODEOWNERS findings — codeowners-org-leads-not-first and codeowners-no-catchall are stale findings: .github/CODEOWNERS already contains * @petry-projects/org-leads which satisfies both checks (catch-all present, org-leads first). Fixed in prior PRs (chore: standardize CODEOWNERS on @petry-projects/org-leads team #192, fix(codeowners): add explicit catch-all comment per codeowners-standard #214).
Fixed check-suite auto-trigger — PATCH API call to repos/petry-projects/.github/check-suites/preferences successfully disabled auto-trigger for Claude (app_id 1236702) and CodeRabbit (app_id 347564). Result: [{"app_id":1236702,"setting":false},{"app_id":347564,"setting":false}]
Created .github/workflows/copilot-setup-steps.yml — copied verbatim from standards/workflows/copilot-setup-steps.yml per AGENTS.md standard ("read the standard, copy the template"). Job name is exactly copilot-setup-steps as required by GitHub.
Attempted secret scanning settings — secret_scanning_ai_detection and secret_scanning_non_provider_patterns PATCH returned disabled/null — these may require GitHub Advanced Security plan features not available on this repo. No file change can remediate this; the API settings are plan-dependent.

Test Results

yamllint .github/workflows/ standards/workflows/ standards/dependabot/ — exit code: 0
actionlint -ignore 'SC2129' .github/workflows/*.yml — exit code: 0
Python compliance check (copilot-setup-steps job name) — PASSED

Files Changed

.github/workflows/copilot-setup-steps.yml: Created — copied verbatim from standards/workflows/copilot-setup-steps.yml; resolves copilot-setup-steps-invalid-job-name finding

API Changes (not file changes)

repos/petry-projects/.github/check-suites/preferences PATCH: disabled auto-trigger for Claude (1236702) and CodeRabbit (347564) — resolves check-suite-auto-trigger-1236702 and check-suite-auto-trigger-347564 findings

Notes

secret_scanning_ai_detection and secret_scanning_non_provider_patterns could not be enabled — the GitHub API returned the settings unchanged, likely because these features require GitHub Advanced Security or a specific org plan tier. These findings will remain until the plan is upgraded or GitHub enables these features for the repo.
CODEOWNERS findings (codeowners-org-leads-not-first, codeowners-no-catchall) are stale from before prior PRs fixed the file — the next audit run should clear them.

Resolved! This check is now passing as of 2026-05-30. Closing automatically.

feat: implement issue #375 — Compliance audit — 2026-05-29

feat: implement issue #375 — Compliance audit — 2026-05-29 (#376)

Navigation Menu

Repository navigation

Compliance audit — 2026-05-29 #375