Compliance audit — 2026-08-14

[don-petry]

Compliance Audit — 2026-08-14

This umbrella issue tracks all findings from the automated compliance audit run on 2026-08-14.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 55 across 9 repositories

---

Remediation Work Breakdown

Repository Settings (5 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: demo-repository

Repo	Check	Severity
demo-repository	allow_auto_merge	warning
demo-repository	delete_branch_on_merge	warning
demo-repository	has_discussions	error
demo-repository	missing-codeowners	error
demo-repository	check-suite-prefs-unreadable	warning

Push Protection & Secret Scanning (6 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: .github-private, demo-repository, markets, repo-template

Repo	Check	Severity
.github-private	gitignore_baseline	error
repo-template	gitignore_baseline	error
markets	gitignore_baseline	error
demo-repository	security_and_analysis_unavailable	warning
demo-repository	secret_scan_ci_job_present	error
demo-repository	gitignore_baseline	error

Repository Rulesets (19 finding(s))

Remediation: apply-rulesets.sh
Affected repos: .github-private, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, demo-repository, google-app-scripts, markets, repo-template

Repo	Check	Severity
.github-private	ruleset-drift-pr-quality-require_last_push_approval	error
repo-template	ruleset-drift-pr-quality-require_last_push_approval	error
TalkTerm	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
TalkTerm	ruleset-drift-pr-quality-require_last_push_approval	error
google-app-scripts	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
google-app-scripts	ruleset-drift-pr-quality-require_last_push_approval	error
broodly	ruleset-drift-pr-quality-require_code_owner_review	error
broodly	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
broodly	ruleset-drift-pr-quality-require_last_push_approval	error
markets	ruleset-bypass-orgadmin-code-quality	error
markets	ruleset-bypass-dependabot-code-quality	error
markets	ruleset-drift-pr-quality-require_code_owner_review	error
markets	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
markets	ruleset-drift-pr-quality-require_last_push_approval	error
ContentTwin	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
ContentTwin	ruleset-drift-pr-quality-require_last_push_approval	error
bmad-bgreat-suite	ruleset-drift-pr-quality-dismiss_stale_reviews_on_push	error
demo-repository	missing-pr-quality	error
demo-repository	missing-code-quality	error

Workflows (17 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github-private, ContentTwin, demo-repository, google-app-scripts

Repo	Check	Severity
.github-private	non-stub-agent-shield.yml	error
google-app-scripts	stub-surface-drift-pr-auto-review.yml-on	error
ContentTwin	stub-surface-drift-dependency-audit.yml-concurrency	warning
ContentTwin	stub-surface-drift-pr-review-mention.yml-concurrency	warning
ContentTwin	stub-surface-drift-pr-auto-review.yml-concurrency	warning
demo-repository	missing-ci.yml	error
demo-repository	missing-sonarcloud.yml	error
demo-repository	missing-dev-lead.yml	error
demo-repository	missing-dependabot-automerge.yml	error
demo-repository	missing-dependency-audit.yml	error
demo-repository	missing-agent-shield.yml	error
demo-repository	missing-pr-review-mention.yml	error
demo-repository	missing-feature-ideation.yml	error
demo-repository	missing-pr-auto-review.yml	error
demo-repository	missing-initiative-driver.yml	error
demo-repository	missing-permissions-auto-assign.yml	warning
demo-repository	missing-permissions-proof-html.yml	warning

Action SHA Pinning (2 finding(s))

Remediation: pin actions to SHA in each workflow file
Affected repos: demo-repository

Repo	Check	Severity
demo-repository	unpinned-actions-auto-assign.yml	error
demo-repository	unpinned-actions-proof-html.yml	error

Dependabot Configuration (2 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: demo-repository, repo-template

Repo	Check	Severity
repo-template	missing-github-actions-ecosystem	error
demo-repository	missing-config	error

Agent Standards (CLAUDE.md / AGENTS.md / copilot-setup-steps.yml) (4 finding(s))

Remediation: per-repo doc and workflow additions
Affected repos: demo-repository

Repo	Check	Severity
demo-repository	missing-claude-md	error
demo-repository	missing-agents-md	error
demo-repository	missing-copilot-setup-steps	warning
demo-repository	missing-copilot-instructions	error

---

Generated by the weekly compliance audit on 2026-08-14 13:30 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.