Compliance: dev-lead-stub-agent-ref

Compliance Finding

Category: ci-workflows
Severity: error
Check: dev-lead-stub-agent-ref

Detail

The dev-lead.yml caller stub must pass with: agent_ref: dev-lead/<channel> (stable, next, or ring<N>) so the reusable checks out its own scripts/prompts from the same channel. Re-sync from standards/workflows/dev-lead.yml.

Standard Reference

standards/ci-standards.md#dev-lead-agent

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml

This issue was automatically created by the weekly compliance audit.

Dev-Lead: implementation deferred — automation PR queue is full

No pull request was opened for issue #448. The org-wide
open-automation-PR queue is currently at its signed-off cap (see
standards/pr-limits.json in petry-projects/.github).

This issue stays labeled dev-lead and will be re-attempted automatically once
the queue drains — no action is required.

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Re-sync .github/workflows/dev-lead.yml from the canonical standards/workflows/dev-lead.yml so the caller stub passes with: agent_ref: dev-lead/<channel> matching its uses: channel pin.

Implementation Checklist

Fetch canonical standards/workflows/dev-lead.yml from petry-projects/.github
Byte-diff against .github/workflows/dev-lead.yml
If drift exists, copy the template verbatim; otherwise confirm already in sync
Verify uses: channel pin and agent_ref: value are consistent

Tests to Write

N/A — config-only workflow stub with no runtime logic in this repo; no Jest surface. Phase 2 TDD exception (behavior-preserving / already-compliant) noted per prompt.

Test Command

bash ".dev-lead/scripts/dev-lead-lint.sh" (repo lint gate); npm test for the JS suite.

Dev-Lead: Implementation Complete

Outcome

No code change was required — the workflow is already compliant.

.github/workflows/dev-lead.yml is byte-identical (cmp, 3998/3998 bytes) to the canonical standards/workflows/dev-lead.yml and already passes:

    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
    with:
      agent_ref: dev-lead/stable

The uses: channel pin (dev-lead/stable) and the agent_ref value (dev-lead/stable) are consistent, satisfying the dev-lead-stub-agent-ref check. Re-applying the remediation (gh api ... | base64 -d > .github/workflows/dev-lead.yml) verbatim produced a zero-line diff.

The audit that filed #448 appears to have run against an older state of the default branch; this branch's base commit already carries the synced stub.

Plan Execution

Fetched canonical standards/workflows/dev-lead.yml
Byte-diffed against the repo copy — identical (cmp byte-exact, no CRLF, matching trailing newline)
Re-applied the verbatim template copy — zero diff
Verified uses: channel pin and agent_ref: are consistent (dev-lead/stable)

Test Results

Phase 2 TDD exception: config-only workflow stub with no repo-side runtime logic and no Jest surface — behavior-preserving / already-compliant, so no new failing test applies. Full suite and lint gates run for verification:

[lint] shellcheck on 4 file(s)...
[lint] validating CODEOWNERS...
OK: CODEOWNERS
[lint] all checks passed

Test Suites: 12 passed, 12 total
Tests:       301 passed, 301 total
Snapshots:   0 total
Time:        4.795 s

npm run check → 0 errors, 22 pre-existing warnings (unused vars in untouched test files), exit 0

Files Changed

None. .github/workflows/dev-lead.yml verified in sync; working tree clean.

Notes

No behavioral change. If the compliance audit does not auto-resolve #448 on its next run against current main, this can be closed manually — the standard is satisfied. No follow-up issues needed.

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Verify the dev-lead.yml caller stub passes with: agent_ref: dev-lead/<channel> matching its uses: channel pin, re-syncing verbatim from standards/workflows/dev-lead.yml if it drifts.

Investigation Checklist

Fetch canonical standards/workflows/dev-lead.yml from petry-projects/.github
Byte-compare against local .github/workflows/dev-lead.yml
Confirm with: agent_ref: dev-lead/stable is present and matches the uses: @dev-lead/stable channel pin
Confirm no other dev-lead caller stub exists in the repo
Run .dev-lead/scripts/dev-lead-lint.sh and repo lint/format/test to confirm repo health

Tests to Write

N/A — this is a CI-workflow / configuration compliance finding with no application code and no observable runtime behavior to unit-test (Phase 2 TDD exception per the dev-lead template).

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh (workflow lint) + npm run check + npm test (repo health)

Preliminary Finding

The local stub already appears identical to the canonical template with agent_ref: dev-lead/stable present. Confirming below before reporting.

Dev-Lead: Implementation Complete — No Change Required (already compliant)

Finding

The dev-lead-stub-agent-ref check requires .github/workflows/dev-lead.yml to pass with: agent_ref: dev-lead/<channel> matching its uses: channel pin. The stub already satisfies this and is byte-for-byte identical to the canonical standards/workflows/dev-lead.yml.

Verification

Canonical fetch vs local diff: identical, 0 bytes of difference.

$ diff <(gh api .../standards/workflows/dev-lead.yml | base64 -d) .github/workflows/dev-lead.yml
=== IDENTICAL (content) ===
Canonical bytes: 3998
Local bytes:     3998

agent_ref present and channel-matched (.github/workflows/dev-lead.yml):

64:    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
66:      agent_ref: dev-lead/stable

uses: channel (@dev-lead/stable) and with: agent_ref (dev-lead/stable) match.

Sole caller stub: grep confirms dev-lead.yml is the only file referencing dev-lead-reusable.yml.
Already on main: both HEAD and origin/main are at 6c0a7da; the agent_ref line was introduced by the Compliance: non-stub-feature-ideation.yml #414 / feat: implement issue #414 — Compliance: non-stub-feature-ideation.yml #441 PR (merged 2026-07-17), which re-synced this stub to the canonical template. That PR resolved this finding; the weekly audit that opened Compliance: dev-lead-stub-agent-ref #448 ran against a pre-feat: implement issue #414 — Compliance: non-stub-feature-ideation.yml #441 state.

Test / Lint Results

$ bash .dev-lead/scripts/dev-lead-lint.sh
[lint] shellcheck on 4 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed   (exit 0)

$ git diff HEAD --stat
(empty — no files changed)

Phase 2 (TDD) skipped per the template exception: pure CI-workflow/config compliance with no application code or observable runtime behavior to unit-test. npm run check was not runnable here (dev dependencies/prettier not installed in this environment), but this is moot — zero files were changed, so there is nothing to format or lint.

Files Changed

None. The stub already matches the canonical template verbatim.

Notes

No source change is required to satisfy dev-lead-stub-agent-ref; the finding is already remediated on main. Since the working tree is clean, no commit/PR will be produced by CI for this branch. Recommend closing #448 as already-resolved (superseded by #441), or re-running the compliance audit against current main to auto-clear it.

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Re-sync .github/workflows/dev-lead.yml from the canonical standards/workflows/dev-lead.yml so the caller stub passes with: agent_ref: dev-lead/<channel> matching its uses: channel pin.

Implementation Checklist

Fetch canonical standards/workflows/dev-lead.yml from petry-projects/.github
Diff against local .github/workflows/dev-lead.yml
Apply verbatim copy if drift is present

Tests to Write

N/A — workflow YAML config change, no unit-testable logic (Phase 2 config exception per prompt)

Test Command

bash ".dev-lead/scripts/dev-lead-lint.sh" (plus repo npm run check / npm test for regression safety)

Initial Finding

Local dev-lead.yml is currently byte-for-byte identical to the canonical template (3998 bytes, diff clean) and already contains with: agent_ref: dev-lead/stable matching the @dev-lead/stable uses: pin. Re-running the remediation gh api … | base64 -d sync produces no diff. Proceeding to verify lint/tests and will report accordingly.

Dev-Lead: Implementation Complete

Outcome: already compliant — no source change required

The compliance finding is already satisfied in the current codebase. .github/workflows/dev-lead.yml is byte-for-byte identical to the canonical standards/workflows/dev-lead.yml and already passes the required input:

  dev-lead:
    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
    with:
      agent_ref: dev-lead/stable
    secrets: inherit

agent_ref: dev-lead/stable matches the @dev-lead/stable channel pin on the uses: ref, so the reusable checks out its own scripts/prompts from the same channel — exactly what check dev-lead-stub-agent-ref requires.

Plan Execution

Fetched canonical standards/workflows/dev-lead.yml via gh api … | base64 -d
Diffed against local stub — 0 differences (both 3998 bytes)
Re-ran the remediation sync command verbatim — produced no diff (git status clean)
Verified the stub carries with: agent_ref: dev-lead/stable matching its uses: pin

Why the finding was flagged

Commit 6c0a7da (issue #414, merged 2026-07-17) added dev-lead.yml already in its correct, agent_ref-bearing form. The audit that opened this issue appears to predate that commit (or ran against an older snapshot); the drift it describes is not present on the current branch/main.

Test Results

No unit-testable logic changed (workflow YAML config — Phase 2 config exception). Verification checks run for repo health:

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck on 4 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed        (exit 0)

$ npm run check
prettier --check .  → pass
eslint              → 0 errors, 22 pre-existing warnings (untouched test files)

$ git status --short
(clean — no files modified)

Files Changed

None. .github/workflows/dev-lead.yml already matches the canonical template verbatim.

Notes

No code change was made because none was warranted — fabricating a no-op diff would be drift, not remediation. This issue can be closed as already-resolved. If the compliance audit re-runs against current main, it should no longer flag dev-lead-stub-agent-ref.

Dev-Lead: Implementation Complete

Outcome

No source change required — the finding was already remediated. The in-repo caller stub is byte-for-byte identical to the canonical standards/workflows/dev-lead.yml and already passes with: agent_ref: dev-lead/stable, matching its uses: ...@dev-lead/stable channel pin. The audit that raised this finding predates commit 027ba0b, which (re)created the file already compliant.

Plan Execution

Read AGENTS.md / CLAUDE.md and CI standards for the dev-lead stub.
Fetched canonical template from petry-projects/.github standards/workflows/dev-lead.yml.
Diffed against .github/workflows/dev-lead.yml → IDENTICAL.
Verified agent_ref: dev-lead/stable matches the @dev-lead/stable uses: ref.
Confirmed only one dev-lead workflow file exists (no stale duplicates).
Ran required lint.

Verification

$ diff /tmp/canonical-dev-lead.yml .github/workflows/dev-lead.yml && echo IDENTICAL
IDENTICAL

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck on 4 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed

Files Changed

None. .github/workflows/dev-lead.yml already matches the standard verbatim.

Notes

No tests written — this is a CI workflow-configuration finding with no application code and no observable behavioral change (Phase 2 config/docs exception). If the compliance audit re-runs against current main/this branch, dev-lead-stub-agent-ref should pass. This issue can be closed as already-resolved.

Dev-Lead: No Change Required — Finding Already Remediated

Summary

The dev-lead-stub-agent-ref finding for .github/workflows/dev-lead.yml is already satisfied in the current repository state (both main and this branch). No source changes were made because none are needed.

Verification performed

Fetched the canonical template from petry-projects/.github:

gh api repos/petry-projects/.github/contents/standards/workflows/dev-lead.yml --jq '.content' | base64 -d

Byte-for-byte comparison — the repo file is identical to canonical:

3133dbcd3b31787ca97855bd384d071e276c8f89d9c83598f0f6891342850a86  canonical standards/workflows/dev-lead.yml
3133dbcd3b31787ca97855bd384d071e276c8f89d9c83598f0f6891342850a86  .github/workflows/dev-lead.yml

diff reports no differences.

Required agent_ref is present and channel-consistent:

uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
with:
  agent_ref: dev-lead/stable

The agent_ref (dev-lead/stable) matches the channel pinned on the uses: ref, satisfying dev-lead/<channel> where <channel> ∈ {stable, next, ring<N>}.

No diff vs main and a clean working tree — the file was already synced prior to this task.

Conclusion

The caller stub is already verbatim-synced from standards/workflows/dev-lead.yml and passes with: agent_ref: dev-lead/stable. This appears to be a stale compliance finding — the audit likely ran against an earlier commit before the file was synced. Per project guidance ("do not implement more than the issue requests"), no files were modified.

Files Changed

None.

Recommendation

Close this issue as already-resolved. If the weekly audit re-flags it, please share the exact audit assertion so we can reconcile it against the byte-identical template above.

Dev-Lead: cannot implement issue #448 — needs human attention

Automatic retries are exhausted (attempt 3 of 3). The most recent failure was engine-error.

Run: https://github.com/petry-projects/google-app-scripts/actions/runs/29884530060

Please review the failures above. To retry anyway, remove the dev-lead:needs-human label and re-apply the dev-lead label.

Last 40 lines of engine output (redacted)

    [copilot] calling gh copilot (model=openai/o4-mini, timeout=2100s, flags=--yolo)
Error: Model "openai/o4-mini" from --model flag is not available.

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Re-sync .github/workflows/dev-lead.yml verbatim from the canonical standards/workflows/dev-lead.yml so the caller stub pins a major-scoped channel (dev-lead/v1-stable) on both the uses: ref and the threaded with: agent_ref:.

Root Cause

The compliance check dev-lead-stub-agent-ref (compliance-audit.sh check_dev_lead_stub) now requires a major-scoped channel dev-lead/v<M>-<channel> (per #657 F5 / #861). The local stub carries a bare dev-lead/stable, so uses_channel fails the v[0-9]+- regex and the agent_ref falls into the else branch, firing the finding. The canonical template uses dev-lead/v1-stable, which satisfies both the pin and agent_ref checks.

Implementation Checklist

Overwrite .github/workflows/dev-lead.yml verbatim from gh api repos/petry-projects/.github/contents/standards/workflows/dev-lead.yml
Confirm resulting diff is limited to the sanctioned per-repo channel pin (stable -> v1-stable) on the uses: ref, agent_ref, and their two comment mentions — no on:/permissions:/concurrency: drift

Tests to Write

TDD exception (Phase 2): behavior-preserving CI/config re-sync of a Tier-1 caller stub; no application logic changes and no repo-side test harness exercises workflow YAML. Verification is via .dev-lead/scripts/dev-lead-lint.sh, npm run check, and npm test (full suite must stay green).

Test Command

.dev-lead/scripts/dev-lead-lint.sh && npm run check && npm test

Dev-Lead: Implementation Complete

Plan Execution

Re-synced .github/workflows/dev-lead.yml verbatim from canonical standards/workflows/dev-lead.yml (verified byte-identical to the fetched template)
Confirmed the resulting diff is limited to the sanctioned per-repo channel pin (bare dev-lead/stable -> major-scoped dev-lead/v1-stable) on the uses: ref, with: agent_ref:, and their two comment mentions — no on: / permissions: / concurrency: drift

Root Cause / Fix

check_dev_lead_stub in compliance-audit.sh now requires a major-scoped channel dev-lead/v<M>-<channel> (#657 F5 / #861). The stub carried a bare dev-lead/stable, so the uses: channel failed the v[0-9]+- match and agent_ref fell into the else branch that fires dev-lead-stub-agent-ref. The canonical dev-lead/v1-stable satisfies both the pin check and the agent_ref-matches-channel check.

Test Results

> jest --runInBand

Test Suites: 12 passed, 12 total
Tests:       301 passed, 301 total
Snapshots:   0 total
Time:        4.728 s
Ran all test suites.

# .dev-lead/scripts/dev-lead-lint.sh -> all checks passed (exit 0)
# npx prettier --check .github/workflows/dev-lead.yml -> All matched files use Prettier code style!
# npm run check (prettier --check . && eslint src) -> 0 errors, 22 pre-existing warnings (unrelated test files), exit 0

Files Changed

.github/workflows/dev-lead.yml: pinned the caller stub to the major-scoped dev-lead/v1-stable channel on the uses: ref and threaded the matching with: agent_ref: dev-lead/v1-stable; updated the two accompanying comment mentions. Copied verbatim from the standards template.

Notes

Phase 2 (TDD) intentionally skipped per the documented exception: this is a behavior-preserving CI/config re-sync of a Tier-1 caller stub with no application logic change and no repo-side harness that exercises workflow YAML. Verification was done via the required dev-lead-lint.sh, prettier/eslint check, and the full 301-test suite (all green).
The eslint warnings are pre-existing (unused vars in gmail-to-drive-by-labels tests) and unrelated to this change.
No follow-up issues needed.

feat: implement issue #448 — Compliance: dev-lead-stub-agent-ref (#477)

Compliance: dev-lead-stub-agent-ref #448

Description

Compliance Finding

Detail

Standard Reference

Remediation

Activity

don-petry commented on Jul 17, 2026

Dev-Lead: implementation deferred — automation PR queue is full

don-petry commented on Jul 19, 2026

Dev-Lead Implementation Plan

Scope

Implementation Checklist

Tests to Write

Test Command

don-petry commented on Jul 19, 2026

Dev-Lead: Implementation Complete

Outcome

Plan Execution

Test Results

Files Changed

Notes

don-petry commented on Jul 19, 2026

Dev-Lead Implementation Plan

Scope

Investigation Checklist

Tests to Write

Test Command

Preliminary Finding

don-petry commented on Jul 19, 2026

Dev-Lead: Implementation Complete — No Change Required (already compliant)

Finding

Verification

Test / Lint Results

Files Changed

Notes

don-petry commented on Jul 19, 2026

Dev-Lead Implementation Plan

Scope

Implementation Checklist

Tests to Write

Test Command

Initial Finding

don-petry commented on Jul 19, 2026

Dev-Lead: Implementation Complete

Outcome: already compliant — no source change required

Plan Execution

Why the finding was flagged

Test Results

Files Changed

Notes

85 remaining items

don-petry commented on Jul 21, 2026

Dev-Lead: Implementation Complete

Outcome

Plan Execution

Verification

Files Changed

Notes

don-petry commented on Jul 21, 2026

Dev-Lead: No Change Required — Finding Already Remediated

Summary

Verification performed

Conclusion

Files Changed

Recommendation

don-petry commented on Jul 22, 2026

Dev-Lead: cannot implement issue #448 — needs human attention

don-petry commented on Jul 22, 2026

Dev-Lead Implementation Plan

Scope

Root Cause

Implementation Checklist

Tests to Write

Test Command

don-petry commented on Jul 22, 2026

Dev-Lead: Implementation Complete

Plan Execution

Root Cause / Fix

Test Results