diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml index 4cf7bb7d..8704981d 100644 --- a/.github/workflows/agent-shield.yml +++ b/.github/workflows/agent-shield.yml @@ -30,4 +30,4 @@ permissions: jobs: agent-shield: - uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@agent-shield/stable + uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@v1 diff --git a/.github/workflows/apply-repo-settings.yml b/.github/workflows/apply-repo-settings.yml index 1b7e384c..c3a3ed19 100644 --- a/.github/workflows/apply-repo-settings.yml +++ b/.github/workflows/apply-repo-settings.yml @@ -2,9 +2,10 @@ # Standard: petry-projects/.github/standards/push-protection.md#required-repo-level-settings # # Applies repository-level security settings (secret_scanning_ai_detection, etc.) -# via scripts/apply-repo-settings.sh on every push to main so that -# security_and_analysis settings documented in .github/settings.yml stay in -# effect. Also triggerable manually for out-of-band remediation. +# via scripts/apply-repo-settings.sh on every push to main and on a weekly +# schedule (Mon 03:00 UTC) so that security_and_analysis settings documented +# in .github/settings.yml stay in effect and drift is caught between compliance +# audits. Also triggerable manually for out-of-band remediation. # # Token: GH_PAT_WORKFLOWS (classic PAT with repo scope). # `administration` is not a valid GITHUB_TOKEN scope in Actions; and the @@ -21,11 +22,16 @@ on: - scripts/apply-repo-settings.sh - .github/workflows/apply-repo-settings.yml schedule: - - cron: '0 6 * * 1' # weekly Monday 06:00 UTC — reinforce settings to prevent drift + # Reinforce settings weekly (Mon 03:00 UTC) so drift is caught between compliance audits. + - cron: '0 3 * * 1' workflow_dispatch: permissions: {} +concurrency: + group: apply-repo-settings + cancel-in-progress: false + jobs: apply: name: Apply security_and_analysis settings diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml index c1c5ef2f..845c3295 100644 --- a/.github/workflows/dependabot-automerge.yml +++ b/.github/workflows/dependabot-automerge.yml @@ -35,5 +35,5 @@ jobs: permissions: contents: read pull-requests: read - uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@dependabot-automerge/stable + uses: petry-projects/.github/.github/workflows/dependabot-automerge-reusable.yml@v1 secrets: inherit diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index c1af742e..f1173774 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -30,4 +30,4 @@ permissions: jobs: dependency-audit: - uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@dependency-audit/stable + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1 diff --git a/.github/workflows/dev-lead.yml b/.github/workflows/dev-lead.yml index 8d6112e7..25cc7785 100644 --- a/.github/workflows/dev-lead.yml +++ b/.github/workflows/dev-lead.yml @@ -43,7 +43,14 @@ permissions: {} jobs: dev-lead: - uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@5a9a2476575cfcf0e730993f589587db054219f1 # main + # Pinned to the moving dev-lead/stable channel tag, not @main, so a broken + # change to dev-lead can no longer gate its own fix (the self-host circular + # dependency). Promotion is done by moving the dev-lead/stable tag centrally; this + # caller is never edited on release. agent_ref threads the same channel into + # dev-lead's own scripts/prompts checkout. See ci-standards.md#dev-lead-agent. + uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@ded84ce4820dce379f177f9992beb74483f6d6b4 # dev-lead/ring1 + with: + agent_ref: dev-lead/ring1 secrets: inherit permissions: contents: write diff --git a/.gitleaksignore b/.gitleaksignore index 70f30ff8..15a64718 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -110,3 +110,54 @@ c5099d1dfbc58bd65ddd0e4efd267666260bb3f6:_bmad/_config/files-manifest.csv:generi 4c9852dcd788730edfb9aaac3c7cca3a6777df9f:_bmad/_config/files-manifest.csv:generic-api-key:300 4c9852dcd788730edfb9aaac3c7cca3a6777df9f:_bmad/_config/files-manifest.csv:generic-api-key:409 4c9852dcd788730edfb9aaac3c7cca3a6777df9f:_bmad/_config/files-manifest.csv:generic-api-key:433 + +# Commit 38e9f745: same _bmad/_config/files-manifest.csv CSV rows as above +# (SHA256 content checksums of BMAD skill files). Same false-positive rationale; +# file content checksums in CSV, not API keys. +38e9f74523fb9c79fa465831381c3ce9ac050c29:_bmad/_config/files-manifest.csv:generic-api-key:281 +38e9f74523fb9c79fa465831381c3ce9ac050c29:_bmad/_config/files-manifest.csv:generic-api-key:282 +38e9f74523fb9c79fa465831381c3ce9ac050c29:_bmad/_config/files-manifest.csv:generic-api-key:284 +38e9f74523fb9c79fa465831381c3ce9ac050c29:_bmad/_config/files-manifest.csv:generic-api-key:300 +38e9f74523fb9c79fa465831381c3ce9ac050c29:_bmad/_config/files-manifest.csv:generic-api-key:409 +38e9f74523fb9c79fa465831381c3ce9ac050c29:_bmad/_config/files-manifest.csv:generic-api-key:433 + +# Commit da36d9b3: same _bmad/_config/files-manifest.csv CSV rows as above +# (SHA256 content checksums of BMAD skill files). Same false-positive rationale; +# file content checksums in CSV, not API keys. Earlier commit with same content. +da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:281 +da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:282 +da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:284 +da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:300 +da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:409 +da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:433 + +# Commits 3d0fa154, 38957566, 449c717b, f57f0350: same _bmad/_config/files-manifest.csv CSV rows +# as above (SHA256 content checksums of BMAD skill files). Same false-positive rationale; +# file content checksums in CSV, not API keys. These additional commits appear in the full-history +# scan but were not previously suppressed. Commit f57f0350 is a rebase/merge copy of the +# "chore: add ECC integration, TEA module, and slim CLAUDE.md" change; 3d0fa154 previously had +# only line 433 suppressed — lines 281, 282, 284, 300, and 409 are added here. +3d0fa154391350f48912593a0a9cd5671dba4ca8:_bmad/_config/files-manifest.csv:generic-api-key:281 +3d0fa154391350f48912593a0a9cd5671dba4ca8:_bmad/_config/files-manifest.csv:generic-api-key:282 +3d0fa154391350f48912593a0a9cd5671dba4ca8:_bmad/_config/files-manifest.csv:generic-api-key:284 +3d0fa154391350f48912593a0a9cd5671dba4ca8:_bmad/_config/files-manifest.csv:generic-api-key:300 +3d0fa154391350f48912593a0a9cd5671dba4ca8:_bmad/_config/files-manifest.csv:generic-api-key:409 +3d0fa154391350f48912593a0a9cd5671dba4ca8:_bmad/_config/files-manifest.csv:generic-api-key:433 +38957566a56f3731d5bd2bc9dcb5e00131e82d74:_bmad/_config/files-manifest.csv:generic-api-key:281 +38957566a56f3731d5bd2bc9dcb5e00131e82d74:_bmad/_config/files-manifest.csv:generic-api-key:282 +38957566a56f3731d5bd2bc9dcb5e00131e82d74:_bmad/_config/files-manifest.csv:generic-api-key:284 +38957566a56f3731d5bd2bc9dcb5e00131e82d74:_bmad/_config/files-manifest.csv:generic-api-key:300 +38957566a56f3731d5bd2bc9dcb5e00131e82d74:_bmad/_config/files-manifest.csv:generic-api-key:409 +38957566a56f3731d5bd2bc9dcb5e00131e82d74:_bmad/_config/files-manifest.csv:generic-api-key:433 +449c717b8353cba9820c2cbd1413dfd83b4b2ea5:_bmad/_config/files-manifest.csv:generic-api-key:281 +449c717b8353cba9820c2cbd1413dfd83b4b2ea5:_bmad/_config/files-manifest.csv:generic-api-key:282 +449c717b8353cba9820c2cbd1413dfd83b4b2ea5:_bmad/_config/files-manifest.csv:generic-api-key:284 +449c717b8353cba9820c2cbd1413dfd83b4b2ea5:_bmad/_config/files-manifest.csv:generic-api-key:300 +449c717b8353cba9820c2cbd1413dfd83b4b2ea5:_bmad/_config/files-manifest.csv:generic-api-key:409 +449c717b8353cba9820c2cbd1413dfd83b4b2ea5:_bmad/_config/files-manifest.csv:generic-api-key:433 +f57f0350a41b516a0c37bd87943ed6d67842980c:_bmad/_config/files-manifest.csv:generic-api-key:281 +f57f0350a41b516a0c37bd87943ed6d67842980c:_bmad/_config/files-manifest.csv:generic-api-key:282 +f57f0350a41b516a0c37bd87943ed6d67842980c:_bmad/_config/files-manifest.csv:generic-api-key:284 +f57f0350a41b516a0c37bd87943ed6d67842980c:_bmad/_config/files-manifest.csv:generic-api-key:300 +f57f0350a41b516a0c37bd87943ed6d67842980c:_bmad/_config/files-manifest.csv:generic-api-key:409 +f57f0350a41b516a0c37bd87943ed6d67842980c:_bmad/_config/files-manifest.csv:generic-api-key:433