From 818e99c50f1aeed7046c290d31b5cdc8ca323f22 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 14:10:44 +0000 Subject: [PATCH 1/7] fix(compliance-audit): suppress gh_api stdout on failure to avoid false positives When gh api returns a 404, it outputs the error JSON to stdout (not stderr). The previous gh_api() forwarded all stdout unconditionally, causing callers like check_codeowners() to receive concatenated 404 JSON blobs instead of empty strings. This made found=true for a missing file and treated the error JSON as CODEOWNERS content, triggering a false codeowners-org-leads-not-first finding. Fix: capture output into a variable and only echo it when the exit code is 0, so failed API calls produce no stdout. Closes #208 Co-authored-by: Don Petry --- scripts/compliance-audit.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/compliance-audit.sh b/scripts/compliance-audit.sh index 9d793e81d..07a68362e 100755 --- a/scripts/compliance-audit.sh +++ b/scripts/compliance-audit.sh @@ -96,8 +96,12 @@ warn() { echo "::warning::$*" >&2; } # Retry wrapper for gh api calls (handles rate limits) gh_api() { local retries=3 + local output rc for i in $(seq 1 $retries); do - if gh api "$@" 2>/dev/null; then + output=$(gh api "$@" 2>/dev/null) + rc=$? + if [ $rc -eq 0 ]; then + echo "$output" return 0 fi if [ "$i" -lt "$retries" ]; then From 2010e831ea465aaf8f2f83c905a630a046e4795e Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 31 May 2026 10:19:42 +0000 Subject: [PATCH 2/7] fix(bot): address bot feedback [skip ci-relay] --- .gitignore | 1 + scripts/compliance-audit.sh | 6 ++---- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 38463791b..af6a1c5bc 100644 --- a/.gitignore +++ b/.gitignore @@ -390,3 +390,4 @@ private.yml # End of petry-projects secrets baseline # ============================================================================ .dev-lead/ +.dev-lead/ diff --git a/scripts/compliance-audit.sh b/scripts/compliance-audit.sh index 53a99524e..e836b01ed 100755 --- a/scripts/compliance-audit.sh +++ b/scripts/compliance-audit.sh @@ -110,11 +110,9 @@ escape_ere() { # Retry wrapper for gh api calls (handles rate limits) gh_api() { local retries=3 - local output rc + local output for i in $(seq 1 $retries); do - output=$(gh api "$@" 2>/dev/null) - rc=$? - if [ $rc -eq 0 ]; then + if output=$(gh api "$@" 2>/dev/null); then echo "$output" return 0 fi From d16e19160f56b13318f1388c14c8a0c12c74e2d0 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 31 May 2026 10:22:37 +0000 Subject: [PATCH 3/7] chore: apply manual instructions [skip ci-relay] --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index af6a1c5bc..e49aaf1e7 100644 --- a/.gitignore +++ b/.gitignore @@ -391,3 +391,4 @@ private.yml # ============================================================================ .dev-lead/ .dev-lead/ +.dev-lead/ From 3f81ad3bedc76b8ca51c5cfedbf6158e771b4c94 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 31 May 2026 10:24:30 +0000 Subject: [PATCH 4/7] chore: apply manual instructions [skip ci-relay] --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index e49aaf1e7..9061774db 100644 --- a/.gitignore +++ b/.gitignore @@ -392,3 +392,4 @@ private.yml .dev-lead/ .dev-lead/ .dev-lead/ +.dev-lead/ From 514a54f402085c36b2db929ced9c96773249a392 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Sun, 31 May 2026 10:26:27 +0000 Subject: [PATCH 5/7] chore: apply manual instructions [skip ci-relay] --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index 9061774db..e2a21eab8 100644 --- a/.gitignore +++ b/.gitignore @@ -393,3 +393,4 @@ private.yml .dev-lead/ .dev-lead/ .dev-lead/ +.dev-lead/ From 9cf6b93fd067dc25787d2d47fecea51e3c2b76e2 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Wed, 3 Jun 2026 01:14:58 +0000 Subject: [PATCH 6/7] chore: apply manual instructions [skip ci-relay] --- .gitignore | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.gitignore b/.gitignore index e2a21eab8..38463791b 100644 --- a/.gitignore +++ b/.gitignore @@ -390,7 +390,3 @@ private.yml # End of petry-projects secrets baseline # ============================================================================ .dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ -.dev-lead/ From 3a4065ced4d99868f18091264a0eef2992aa0d5e Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Mon, 8 Jun 2026 21:49:47 +0000 Subject: [PATCH 7/7] chore: apply manual instructions [skip ci-relay] --- .github/workflows/dependabot-rebase-reusable.yml | 1 - scripts/compliance-audit.sh | 4 ++-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependabot-rebase-reusable.yml b/.github/workflows/dependabot-rebase-reusable.yml index 6de4edf1e..f3ed8ee49 100644 --- a/.github/workflows/dependabot-rebase-reusable.yml +++ b/.github/workflows/dependabot-rebase-reusable.yml @@ -182,4 +182,3 @@ jobs: echo " Warning: failed to merge PR #$PR_NUMBER" fi done <<< "$PRS" - diff --git a/scripts/compliance-audit.sh b/scripts/compliance-audit.sh index b166be5a2..4c562dc04 100755 --- a/scripts/compliance-audit.sh +++ b/scripts/compliance-audit.sh @@ -1144,7 +1144,7 @@ check_copilot_instructions() { --jq '.content' 2>/dev/null || echo "") if [ -z "$content" ]; then - add_finding "$repo" "standards" "missing-copilot-instructions" "warning" \ + add_finding "$repo" "standards" "missing-copilot-instructions" "error" \ "Missing \`.github/copilot-instructions.md\`. Every repo must have its own Copilot instructions file — Copilot instruction files are repository-scoped and do not propagate from the \`petry-projects/.github\` repo. Copy the canonical template from \`standards/copilot-instructions-standard.md\` in \`petry-projects/.github\`, then tailor it with this repo's specific tech stack, project structure, local dev commands, required environment variables, and testing configuration." \ "standards/copilot-instructions-standard.md" return @@ -1328,7 +1328,7 @@ GH_TOKEN= bash scripts/apply-repo-settings.sh ${repo} This script applies all standard settings defined in \`standards/github-settings.md\` in one pass. For a dry run to preview changes without applying: \`DRY_RUN=true GH_TOKEN= bash scripts/apply-repo-settings.sh ${repo}\`" ;; - workflows) + ci-workflows|workflows) remediation_steps="Copy the relevant workflow template from \`standards/workflows/\` verbatim — do not generate from scratch: \`\`\`bash