Compliance: security_and_analysis_unavailable

Compliance Finding

Category: push-protection
Severity: warning
Check: security_and_analysis_unavailable

Detail

Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard Reference

standards/push-protection.md#required-repo-level-settings

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Weekly Compliance Audit (2026-04-09)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Claude encountered an error —— View job

I'll analyze this and get back to you.

Weekly Compliance Audit (2026-04-10)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

@don-petry

Claude finished @don-petry's task in 13m 3s —— View job • claude/issue-111-20260414-1224 • [Create PR ➔](https://github.com/petry-projects/broodly/compare/main...claude/issue-111-20260414-1224?quick_pull=1&title=Issue%20%23111%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23111%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Fixing Compliance Issue #111

Gather context: read push-protection standard and existing repo workflows
Understand the finding
Add secret-scan job to ci.yml
Add *.pem to .gitignore
Fix: gitleaks CLI binary (no org license fee), SHA-256 pinned to v8.30.1
Fix: .gitleaks.toml to suppress 7 false positives in _bmad/ (SHA-256 hashes in manifest CSV + truncated JWT placeholder in test docs)
CI passing — all checks green ✓ (SonarCloud Code Analysis failure is pre-existing, also present on merged ci: add agent-shield.yml workflow #97)
Tagged @don-petry for review

PR: petry-projects/broodly#127

What was changed:

File	Change
`.github/workflows/ci.yml`	Added `secret-scan` job — installs gitleaks v8.30.1 (SHA-256 verified), scans full history with `--redact --verbose --exit-code 1`
`.gitignore`	Added `*.pem` (required by `gitignore_secrets_block` compliance check)
`.gitleaks.toml`	New file — path allowlist for `_bmad/` to suppress false positives

Required admin action (cannot be done via code):

The security_and_analysis_unavailable finding (the original warning) requires a repo admin to enable GitHub's native secret scanning and push protection:

gh api -X PATCH "repos/petry-projects/broodly" \
  -F 'security_and_analysis={"secret_scanning":{"status":"enabled"},"secret_scanning_push_protection":{"status":"enabled"},"secret_scanning_ai_detection":{"status":"enabled"},"secret_scanning_non_provider_patterns":{"status":"enabled"},"dependabot_security_updates":{"status":"enabled"}}'

Or via Settings → Code security in the GitHub UI.

fix: add secret-scan CI job and *.pem gitignore entry

Weekly Compliance Audit (2026-04-17)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

@don-petry

Claude finished @don-petry's task in 4m 37s —— View job • claude/issue-111-20260418-1847 • [Create PR ➔](https://github.com/petry-projects/broodly/compare/main...claude/issue-111-20260418-1847?quick_pull=1&title=Issue%20%23111%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23111%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Fixing Compliance Issue #111

What was changed:

File	Change
`.github/workflows/ci.yml`	Added `secret-scan` job — gitleaks v2.3.9 (SHA pinned), full-history checkout, `--redact` output
`.gitignore`	Added `*.pem` — satisfies `gitignore_secrets_block` audit check
`.gitleaks.toml`	New file — path allowlist for `_bmad/` to suppress false positives (SHA-256 hashes in manifests, placeholder tokens in docs)

Required admin action (cannot be done via code):

The security_and_analysis_unavailable root finding requires a repo admin to enable GitHub's native secret scanning:

GitHub UI: Settings → Code security → enable Secret scanning + Push protection
API:

gh api -X PATCH "repos/petry-projects/broodly" --input - <<'JSON'
{
  "security_and_analysis": {
    "secret_scanning": {"status": "enabled"},
    "secret_scanning_push_protection": {"status": "enabled"},
    "secret_scanning_ai_detection": {"status": "enabled"},
    "secret_scanning_non_provider_patterns": {"status": "enabled"},
    "dependabot_security_updates": {"status": "enabled"}
  }
}
JSON

• Branch

fix: add secret-scan CI job and *.pem gitignore entry

@don-petry

Claude finished @don-petry's task in 8m 26s —— View job • claude/issue-111-20260420-0233 • [Create PR ➔](https://github.com/petry-projects/broodly/compare/main...claude/issue-111-20260420-0233?quick_pull=1&title=Issue%20%23111%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23111%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

Fixing Compliance Issue #111

What was changed:

File	Change
`.github/workflows/ci.yml`	Added `secret-scan` job — gitleaks CLI v8.30.1 (SHA-256 pinned), full-history checkout, `--redact` output
`.gitignore`	Added `.pem`, `secrets.yaml`, `secrets.yml`, `.secrets.yaml`, `*.secrets.yml` — satisfies `gitignore_secrets_block` audit check
`.gitleaks.toml`	New file — path allowlist for `_bmad/` and `_bmad-output/` to suppress false positives

Required admin action (cannot be done via code):

The security_and_analysis_unavailable root finding requires a repo admin to enable GitHub's native secret scanning:

gh api -X PATCH "repos/petry-projects/broodly" --input - <<'JSON'
{
  "security_and_analysis": {
    "secret_scanning": {"status": "enabled"},
    "secret_scanning_push_protection": {"status": "enabled"},
    "secret_scanning_ai_detection": {"status": "enabled"},
    "secret_scanning_non_provider_patterns": {"status": "enabled"},
    "dependabot_security_updates": {"status": "enabled"}
  }
}
JSON

Or via Settings → Code security in the GitHub UI.
• Branch

fix(security): add gitleaks secret-scan CI job and gitignore secrets …

Weekly Compliance Audit (2026-04-21)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Weekly Compliance Audit (2026-04-24)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Weekly Compliance Audit (2026-05-01)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Weekly Compliance Audit (2026-05-08)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Weekly Compliance Audit (2026-05-11)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Weekly Compliance Audit (2026-05-12)

This finding is still open.

Detail: Could not fetch security_and_analysis — token may lack admin scope, or the repo's plan does not expose these settings

Standard: standards/push-protection.md#required-repo-level-settings

Resolved! This check is now passing as of 2026-05-12. Closing automatically.

Resolved! This check is now passing as of 2026-06-05. Closing automatically.

Navigation Menu

Repository navigation

Compliance: security_and_analysis_unavailable #111

Compliance Finding

Detail

Standard Reference

Remediation

Fixing Compliance Issue #111

Fixing Compliance Issue #111

Fixing Compliance Issue #111

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Compliance: security_and_analysis_unavailable #111

Description

Compliance Finding

Detail

Standard Reference

Remediation

Activity

don-petry commented on Apr 9, 2026

don-petry commented on Apr 9, 2026

don-petry commented on Apr 10, 2026

don-petry commented on Apr 14, 2026

Fixing Compliance Issue #111

don-petry commented on Apr 17, 2026

don-petry commented on Apr 18, 2026

Fixing Compliance Issue #111

don-petry commented on Apr 20, 2026

Fixing Compliance Issue #111

don-petry commented on Apr 21, 2026

don-petry commented on Apr 24, 2026

don-petry commented on May 1, 2026

don-petry commented on May 8, 2026

don-petry commented on May 11, 2026

don-petry commented on May 12, 2026

don-petry commented on May 12, 2026

don-petry commented on Jun 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions