Compliance: stub-surface-drift-feature-ideation.yml-permissions #330

Activity

1. don-petry

   added

   compliance-auditAutomated compliance audit findingAutomated compliance audit finding

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Jul 17, 2026
2. don-petry commented on Jul 17, 2026

   

   don-petry

   on Jul 17, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #330 — Compliance: stub-surface-drift-feature-ideation.yml-permissions

   Scope

   Re-sync .github/workflows/feature-ideation.yml with the canonical standards/workflows/feature-ideation.yml so the caller stub's permissions: surface matches the centrally-owned template.

   Root Cause

   The audit's check_stub_surface_drift concatenates every permissions: block in the stub (top-level + each job) and compares it to the canonical. The deployed stub is a stale revision: it predates the canonical's redispatch and prep bridge jobs (each carrying permissions: {}), so its permissions surface is missing those two {} blocks. It also still SHA-pins the reusable (@…v1) instead of the @feature-ideation/stable channel used by the sibling stubs (agent-shield, pr-auto-review). The only per-repo-adjustable field, project_context, is still the unmodified TODO placeholder in both, so nothing repo-specific is lost by re-syncing.

   Implementation Checklist

   • Overwrite .github/workflows/feature-ideation.yml verbatim from standards/workflows/feature-ideation.yml (fetched via gh api), per the issue's remediation ("copy the template verbatim — do not generate from scratch")

   Tests to Write

   • N/A — this is a configuration sync with no repo-side behavioral tests. The governing check (stub-surface-drift) lives in petry-projects/.github, not this repo. Verification is a direct surface comparison (concatenated permissions: blocks must equal the canonical). Phase 2 TDD exception noted.

   Test Command

   bash .dev-lead/scripts/dev-lead-lint.sh (repo lint gate; no unit-test runner is defined for workflow YAML)
3. don-petry commented on Jul 17, 2026

   

   don-petry

   on Jul 17, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Plan Execution

   • Confirmed root cause: deployed stub was a stale revision missing the canonical's redispatch + prep bridge jobs, so its concatenated permissions: surface lacked their two permissions: {} blocks
   • Overwrote .github/workflows/feature-ideation.yml verbatim from standards/workflows/feature-ideation.yml
   • Verified file is byte-identical to canonical and permissions surface now matches
   • Ran repo lint gate (.dev-lead/scripts/dev-lead-lint.sh) — passed
   • Validated YAML parses cleanly

   Test Results

   No repo-side unit tests govern this stub — the stub-surface-drift check lives in petry-projects/.github. Verification was done by (1) reproducing the audit's permissions: block extraction/normalization and confirming it matches the canonical, and (2) the repo lint gate. Phase 2 TDD exception applies (behavior-preserving configuration sync).

     [lint] shellcheck: no .sh files found — skipping
     [lint] validating CODEOWNERS...
   OK: CODEOWNERS
     [lint] all checks passed
   
   Permissions surface (deployed, post-sync):
   permissions: {}
       permissions: {}        # redispatch job
       permissions: {}        # prep job
       permissions:           # ideate job
         contents: read
         issues: read
         pull-requests: read
         discussions: write
         id-token: write
         actions: read
   
   diff vs canonical standards/workflows/feature-ideation.yml: IDENTICAL
   YAML parse: OK  (jobs: redispatch, prep, ideate)
   

   Files Changed

   • .github/workflows/feature-ideation.yml: re-synced verbatim to the canonical template. Adopts the newer redispatch (discussion→dispatch bridge) and prep (input resolution) jobs, restoring the two centrally-owned permissions: {} blocks that were absent. Also brings the uses: pin in line with sibling stubs (@feature-ideation/stable channel + inline # NOSONAR(githubactions:S7637) marker) and syncs the on:/concurrency: surfaces, which are owned centrally alongside permissions:.

   Notes

   • The only per-repo-adjustable field, project_context, was the unmodified TODO placeholder both before and after, so no repo-specific customization was lost.
   • Copying verbatim (per the issue's remediation) also aligns the on: and concurrency: surfaces; these are centrally owned and were consistent with the same stale-revision drift, so re-syncing resolves them together.
   • No unrelated files were modified.
4. don-petry commented on Jul 24, 2026

   

   don-petry

   on Jul 24, 2026

   ContributorAuthor

   More actions

   Weekly Compliance Audit (2026-07-24)

   This finding is still open.

   Detail: The feature-ideation.yml caller stub's permissions: surface has drifted from the canonical standards/workflows/feature-ideation.yml. These stubs are thin callers — the on: triggers, permissions: grants, and concurrency: block are owned centrally and are not repo-adjustable (only the documented with: inputs and the tier channel pin may differ per repo). Re-sync permissions: from standards/workflows/feature-ideation.yml.

   Standard: standards/ci-standards.md#centralization-tiers
5. don-petry

   added

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   and removed

   dev-leadFor dev-lead agent pickupFor dev-lead agent pickup

   on Jul 24, 2026
6. don-petry commented on Jul 24, 2026

   

   don-petry

   on Jul 24, 2026

   ContributorAuthor

   More actions

   Dev-Lead Implementation Plan

   Issue: #330 — Compliance: stub-surface-drift-feature-ideation.yml-permissions

   Scope

   Re-sync .github/workflows/feature-ideation.yml from the canonical standards/workflows/feature-ideation.yml (copy verbatim), preserving only the documented per-repo project_context edit, to restore the centrally-owned permissions: surface.

   Root Cause

   The repo stub is an older revision: the canonical template has since added the redispatch (#963) and prep (#571) jobs, each carrying its own permissions: {} block. The repo stub is missing those jobs, so its permissions: surface (2 blocks) no longer matches canonical (4 blocks). The ideate job's grants and the top-level permissions: {} are already identical.

   Implementation Checklist

   • Overwrite .github/workflows/feature-ideation.yml verbatim from standards/workflows/feature-ideation.yml
   • Re-apply the Markets-specific project_context block (the only documented per-repo edit); confirm the tier channel pin @feature-ideation/v1-stable is unchanged
   • Confirm no other per-repo customizations were lost

   Tests to Write

   • N/A — pure CI-workflow config re-sync with no application code and no observable behavioral change. Per the Phase 2 exception, TDD is skipped and noted here. This repo has no JS/Python test suite (no package.json, planning-stage BMAD repo).

   Verification / Test Command

   bash ".dev-lead/scripts/dev-lead-lint.sh" plus a diff confirming the workflow matches canonical except for the project_context paragraph.
7. don-petry commented on Jul 24, 2026

   

   don-petry

   on Jul 24, 2026

   ContributorAuthor

   More actions

   Dev-Lead: Implementation Complete

   Plan Execution

   • Overwrote .github/workflows/feature-ideation.yml verbatim from canonical standards/workflows/feature-ideation.yml
   • Re-applied the Markets-specific project_context (the only documented per-repo edit); confirmed tier channel pin @feature-ideation/v1-stable unchanged
   • Confirmed no other per-repo customizations existed to preserve

   Root Cause

   The repo stub was an older revision missing the canonical redispatch (#963) and prep (#571) jobs, each of which carries its own permissions: {} block. That made the stub's permissions: surface (2 blocks) drift from canonical (4 blocks). The top-level permissions: {} and the ideate job grants were already identical.

   Verification Results

   Post-sync, the synced file differs from canonical only in the project_context paragraph:

   198,200c198,208
   <         TODO: Replace this with a description of the project and its market.
   <         Example: "ProjectX is a [type of product] for [target user]. Competitors
   <         include A, B, C. Key emerging trends in this space: X, Y, Z."
   ---
   >         Markets is a mobile app (React Native / Expo) that connects
   >         farmers-market shoppers, vendors, and market managers — making it easy
   >         to discover nearby markets, browse vendor catalogs, and support local
   >         food. It serves three roles: customers who find markets and produce,
   >         vendors who manage their stall and catalog, and managers who run the
   >         market, all through a mobile-first, accessibility-conscious UX. Target
   >         users are local-food shoppers and small independent vendors, many of
   >         whom are app-averse. Competitors include LocalHarvest, Farmish,
   >         GoingGrocery, and generic marketplace/event apps. Emerging trends in
   >         this space: digital SNAP/EBT acceptance, on-device produce recognition,
   >         low-friction SMS-based vendor onboarding, and hyper-local discovery.
   

   permissions: surface now matches canonical — top-level {}, redispatch: {}, prep: {}, and the ideate grants (contents/issues/pull-requests read, discussions/id-token write, actions read).

   YAML parses cleanly (jobs: redispatch, prep, ideate). Lint passed:

     [lint] shellcheck: no .sh files found — skipping
     [lint] validating CODEOWNERS...
   OK: CODEOWNERS
     [lint] all checks passed
   

   Files Changed

   • .github/workflows/feature-ideation.yml: re-synced verbatim from the canonical template (restores centrally-owned on:/permissions:/concurrency: and the redispatch/prep job architecture); preserved the Markets project_context.

   Notes

   • TDD exception (Phase 2): pure CI-workflow config re-sync — no application code and no observable behavioral change. This is a planning-stage BMAD repo with no JS/Python test suite (package.json absent), so there is no unit-test framework to exercise; validation is YAML parse + dev-lead lint + diff-against-canonical.
   • The verbatim copy also brings the on: triggers, concurrency:, and with: wiring back in line with canonical (all centrally owned) — a side effect of the mandated verbatim re-sync, not extra scope.
8. don-petry

   added a commit that references this issue on Jul 24, 2026

   feat: implement issue #330 — Compliance: stub-surface-drift-feature-i…

   ...

   6b75228
9. don-petry

   closed this as completedin #378on Jul 24, 2026