Compliance: secret_scanning_non_provider_patterns #227

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   claude

   on May 26, 2026
2. don-petry commented on May 26, 2026

   

   don-petry

   on May 26, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #227 — Compliance: secret_scanning_non_provider_patterns

   Scope

   Enable GitHub's secret_scanning_non_provider_patterns repository-level security setting and update .github/scripts/apply-repo-settings.sh to enforce all required security-and-analysis settings on future idempotent runs.

   Implementation Checklist

   • Apply secret_scanning_non_provider_patterns: enabled to the repository via the GitHub API
   • Update .github/scripts/apply-repo-settings.sh to include the full security_and_analysis block (covering secret_scanning, secret_scanning_push_protection, secret_scanning_non_provider_patterns, and dependabot_security_updates) so future runs remain compliant

   Tests to Write

   • N/A — TDD Phase 2 exception applies: this is a pure repository configuration change with no application code to test. Verification is performed by gh api repos/petry-projects/markets --jq '.security_and_analysis' before and after the change.

   Test Command

   gh api repos/petry-projects/markets --jq '.security_and_analysis'
3. don-petry commented on May 29, 2026

   

   don-petry

   on May 29, 2026

   ContributorAuthor

   More actions

   Weekly Compliance Audit (2026-05-29)

   This finding is still open.

   Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

   Standard: standards/push-protection.md#required-repo-level-settings
4. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on May 30, 2026
5. don-petry commented on May 30, 2026

   

   don-petry

   on May 30, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #227 — Compliance: secret_scanning_non_provider_patterns

   Scope

   Create a GitHub Actions workflow that enables secret_scanning_non_provider_patterns on push to main, using the existing apply-secret-scanning-non-provider-patterns.sh script.

   Implementation Checklist

   • Create .github/workflows/compliance-settings.yml — self-healing workflow that runs the existing apply scripts on push to main and workflow_dispatch

   Tests to Write

   • N/A — Phase 2 (TDD) exception: this is a pure GitHub Actions workflow configuration change with no observable behavioral change testable by unit/integration tests. No production code is modified.

   Test Command

   N/A (configuration-only change)

   Notes

   • The apply scripts (.github/scripts/apply-secret-scanning-non-provider-patterns.sh etc.) already exist and are correct
   • The gap is that no workflow runs them automatically; the new workflow closes that gap
   • The workflow uses GH_PAT (admin-scoped PAT) already available in org secrets
   • Workflow gracefully skips when GH_PAT is not configured (mirrors sonarcloud.yml pattern)
   • On merge to main the workflow runs and enables the setting, satisfying the compliance audit
6. don-petry commented on May 30, 2026

   

   don-petry

   on May 30, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Plan Execution

   • Created .github/workflows/compliance-settings.yml — self-healing workflow that enables secret_scanning_non_provider_patterns on every push to main

   Test Results

   Phase 2 (TDD) exception: pure GitHub Actions workflow configuration change.
   No production code was modified; no unit/integration tests apply.
   The apply script (.github/scripts/apply-secret-scanning-non-provider-patterns.sh)
   pre-existed and is unchanged.
   

   Files Changed

   • .github/workflows/compliance-settings.yml (new): Workflow triggered on push to main and workflow_dispatch that runs the existing apply-secret-scanning-non-provider-patterns.sh script using the GH_PAT org secret (administration:write scope). Step is skipped gracefully when GH_PAT is not configured, mirroring the sonarcloud.yml pattern.

   Notes

   • On merge to main this workflow runs automatically and enables secret_scanning_non_provider_patterns, satisfying the compliance audit.
   • GH_PAT must be configured as an org or repo secret with administration:write scope (already used by other workflows in this org).
   • The workflow is idempotent — safe to run multiple times.
   • checkout action is pinned to SHA 34e114876b0b11c390a56381ad16ebd13914f8d5 (v4), consistent with all other workflows in this repo.
7. don-petry commented on May 30, 2026

   

   don-petry

   on May 30, 2026

   ContributorAuthor

   More actions

   Weekly Compliance Audit (2026-05-30)

   This finding is still open.

   Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

   Standard: standards/push-protection.md#required-repo-level-settings
8. don-petry commented on May 30, 2026

   

   don-petry

   on May 30, 2026

   ContributorAuthor

   More actions

   @don-petry-dev-lead
9. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Jun 3, 2026
10. don-petry commented on Jun 5, 2026

    

    don-petry

    on Jun 5, 2026

    ContributorAuthor

    More actions

    Weekly Compliance Audit (2026-06-05)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings
11. don-petry

    added

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    and removed

    claude

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    on Jun 6, 2026
12. don-petry commented on Jun 12, 2026

    

    don-petry

    on Jun 12, 2026

    ContributorAuthor

    More actions

    Weekly Compliance Audit (2026-06-12)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings
13. don-petry

    added

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    and removed

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    on Jun 12, 2026
14. don-petry commented on Jun 19, 2026

    

    don-petry

    on Jun 19, 2026

    ContributorAuthor

    More actions

    Weekly Compliance Audit (2026-06-19)

    This finding is still open.

    Detail: Secret scanning non-provider patterns should be enabled (requires GitHub Advanced Security) (current: disabled, expected: enabled)

    Standard: standards/push-protection.md#required-repo-level-settings
15. don-petry

    added

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    and removed

    dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

    on Jun 19, 2026
16. don-petry commented on Jun 19, 2026

    

    don-petry

    on Jun 19, 2026

    ContributorAuthor

    More actions

    Dev-Lead Implementation Plan

    Issue: #227 — Compliance: secret_scanning_non_provider_patterns

    Scope

    Wire the existing apply-secret-scanning-non-provider-patterns.sh enablement into the orchestrator that the "Apply repo settings" workflow actually runs, so secret_scanning_non_provider_patterns is set to enabled on every apply.

    Root cause

    .github/scripts/apply-secret-scanning-non-provider-patterns.sh already exists and correctly PATCHes the setting to enabled, but nothing invokes it. The apply-repo-settings.yml workflow runs only apply-repo-settings.sh, which patches merge/issue settings and check-suite preferences — it never touches security_and_analysis. So the setting is never applied and the compliance audit reports it as disabled.

    Implementation Checklist

    • .github/scripts/apply-repo-settings.sh — invoke the dedicated apply-secret-scanning-non-provider-patterns.sh (resolved via script dir) so the workflow applies the setting

    Tests to Write

    • .github/scripts/tests/apply-repo-settings.bats — assert the orchestrator wires in the non-provider-patterns enablement
    • .github/scripts/tests/apply-secret-scanning-non-provider-patterns.bats — assert the dedicated script PATCHes secret_scanning_non_provider_patterns to enabled and uses set -euo pipefail

    Test Command

    bats .github/scripts/tests/ plus shellcheck --severity=warning -x on changed scripts and bash .dev-lead/scripts/dev-lead-lint.sh
17. don-petry commented on Jun 19, 2026

    

    don-petry

    on Jun 19, 2026

    ContributorAuthor

    More actions

    Dev-Lead: Implementation Complete

    Plan Execution

    • Identified root cause: apply-secret-scanning-non-provider-patterns.sh existed but was never invoked; the apply-repo-settings.yml workflow runs only apply-repo-settings.sh, which never touched security_and_analysis
    • Wrote failing bats test asserting the orchestrator wires in the enablement (red)
    • Added bats tests locking the dedicated script's PATCH behavior
    • Wired the dedicated script into apply-repo-settings.sh (green)
    • Verified: full bats suite, shellcheck (--severity=warning -x), and dev-lead-lint.sh

    Test Results

    1..11
    ok 1 script exists and is executable
    ok 2 script disables CodeRabbit (347564) auto-trigger
    ok 3 script disables Claude (1236702) auto-trigger
    ok 4 script uses set -euo pipefail
    ok 5 script targets petry-projects/markets repo
    ok 6 script wires in secret_scanning_non_provider_patterns enablement (issue #227)
    ok 7 script exists and is executable
    ok 8 script uses set -euo pipefail
    ok 9 script targets petry-projects/markets repo
    ok 10 script PATCHes secret_scanning_non_provider_patterns to enabled
    ok 11 script requires GH_TOKEN
    
    shellcheck: SHELLCHECK_OK
    dev-lead-lint: all checks passed
    

    Files Changed

    • .github/scripts/apply-repo-settings.sh: resolve SCRIPT_DIR via BASH_SOURCE and invoke apply-secret-scanning-non-provider-patterns.sh so the "Apply repo settings" workflow enables the setting on every apply
    • .github/scripts/tests/apply-repo-settings.bats: added wiring assertion for issue Compliance: secret_scanning_non_provider_patterns #227
    • .github/scripts/tests/apply-secret-scanning-non-provider-patterns.bats: new test file locking the dedicated script's PATCH of secret_scanning_non_provider_patterns to enabled

    Notes

    • The setting flips to enabled only when the "Apply repo settings" workflow runs against main with the GH_TOKEN_ADMIN secret (administration:write). The workflow triggers on push to main touching apply-repo-settings.sh, so merging this change will re-run it; it can also be triggered manually via workflow_dispatch.
    • Scope kept to this finding only — secret_scanning_ai_detection has its own dedicated script and is tracked separately, so it was intentionally not wired here.
    • dev-lead-lint.sh reports "no .sh files found" because it globs scripts/**/*.sh; this repo's scripts live under .github/scripts/. shellcheck was run directly on the changed scripts to compensate.
18. don-petry

    added a commit that references this issue on Jun 19, 2026

    feat: implement issue #227 — Compliance: secret_scanning_non_provider…

    ...

    9c3e3a4
19. don-petry

    closed this as completedin #285on Jun 19, 2026