feat: implement issue #466 — [Fleet Monitor] petry-projects/TalkTerm — .github/workflows/pr-auto-review.yml

.github/workflows/apply-repo-settings.yml

@@ -7,8 +7,7 @@
 # compliance audits. Also triggerable manually for out-of-band remediation.
 # Reconciles: security_and_analysis settings (secret_scanning_ai_detection, etc.),
 # check-suite auto-trigger preferences, and the pr-quality ruleset's
-# allowed_merge_methods (squash-only), dismiss_stale_reviews_on_push (true), and
-# require_last_push_approval (true).
+# allowed_merge_methods (squash-only) and dismiss_stale_reviews_on_push (true).
 #
 # Token: GH_PAT_WORKFLOWS (classic PAT with repo scope).
 # `administration` is not a valid GITHUB_TOKEN scope in Actions; and the

.github/workflows/ci.yml

@@ -122,4 +122,5 @@ jobs:
           bash scripts/test-copilot-setup-steps-workflow.sh
           bash scripts/test-sonarcloud-workflow.sh
           bash scripts/test-sonarcloud-workflow.test.sh
-          bash scripts/apply-repo-settings.test.sh
+          bash scripts/test-pr-auto-review-workflow.sh
+          bash scripts/test-pr-auto-review-workflow.test.sh

.github/workflows/pr-auto-review.yml

@@ -46,6 +46,16 @@ permissions: {}
 
 jobs:
   pr-auto-review:
+    # Dependabot-triggered `pull_request` events run against the Dependabot secret
+    # store, where GH_PAT_WORKFLOWS is unavailable. The secret then arrives empty
+    # and the reusable's authenticated checkout / gh calls fail at startup with
+    # "Input required and not supplied: token" — that event can never succeed
+    # (Fleet Monitor #466). Skip it here (the caller is the only place that can:
+    # a reusable cannot rescue a run it was handed no secret for). Readiness for
+    # Dependabot PRs is still evaluated via workflow_run (CI green) and
+    # check_suite, which run in the base-repo context with the PAT available.
+    # Guarded by scripts/test-pr-auto-review-workflow.sh.
+    if: "!(github.event_name == 'pull_request' && github.actor == 'dependabot[bot]')" # NOSONAR(githubactions:S6549)
     permissions:
       pull-requests: read
       checks: read

.gitleaksignore

@@ -131,6 +131,16 @@ da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generi
 da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:409
 da36d9b36916087f02c4c367ad6107ab7dbdb152:_bmad/_config/files-manifest.csv:generic-api-key:433
 
+# Commit 63094bda: same _bmad/_config/files-manifest.csv CSV rows as above
+# (SHA256 content checksums of BMAD skill files). Same false-positive rationale;
+# file content checksums in CSV, not API keys.
+63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:281
+63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:282
+63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:284
+63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:300
+63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:409
+63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:433
+
 # Commits 3d0fa154, 38957566, 449c717b, f57f0350: same _bmad/_config/files-manifest.csv CSV rows
 # as above (SHA256 content checksums of BMAD skill files). Same false-positive rationale;
 # file content checksums in CSV, not API keys. These additional commits appear in the full-history
@@ -262,17 +272,6 @@ b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generi
 b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:409
 b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:433
 
-# Commit 63094bda: same _bmad/_config/files-manifest.csv CSV rows as above
-# (SHA256 content checksums of BMAD skill files). Same false-positive rationale;
-# file content checksums in CSV, not API keys. This commit was discovered during
-# full-history scan in PR #472 but was not previously suppressed.
-63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:281
-63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:282
-63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:284
-63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:300
-63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:409
-63094bdaa8533a4ba27533b6ff5a276aaf5f6377:_bmad/_config/files-manifest.csv:generic-api-key:433
-
 # Commit fdbb5983 (PR #472 test-merge commit): same _bmad/_config/files-manifest.csv CSV rows
 # (SHA256 content checksums of BMAD skill files) and _bmad/tea/testarch/knowledge/api-testing-patterns.md
 # L681 (expired/example token in a test-design knowledge article). Same false-positive rationale as
@@ -284,3 +283,13 @@ fdbb5983697cf867bf3a08d1483322f2a9476c28:_bmad/_config/files-manifest.csv:generi
 fdbb5983697cf867bf3a08d1483322f2a9476c28:_bmad/_config/files-manifest.csv:generic-api-key:409
 fdbb5983697cf867bf3a08d1483322f2a9476c28:_bmad/_config/files-manifest.csv:generic-api-key:433
 fdbb5983697cf867bf3a08d1483322f2a9476c28:_bmad/tea/testarch/knowledge/api-testing-patterns.md:generic-api-key:681
+
+# Commit a7a24535: same _bmad/_config/files-manifest.csv CSV rows as above
+# (SHA256 content checksums of BMAD skill files). Same false-positive rationale;
+# file content checksums in CSV, not API keys.
+a7a24535a6a70b141ef3f23de6648869d86c5a25:_bmad/_config/files-manifest.csv:generic-api-key:281
+a7a24535a6a70b141ef3f23de6648869d86c5a25:_bmad/_config/files-manifest.csv:generic-api-key:282
+a7a24535a6a70b141ef3f23de6648869d86c5a25:_bmad/_config/files-manifest.csv:generic-api-key:284
+a7a24535a6a70b141ef3f23de6648869d86c5a25:_bmad/_config/files-manifest.csv:generic-api-key:300
+a7a24535a6a70b141ef3f23de6648869d86c5a25:_bmad/_config/files-manifest.csv:generic-api-key:409
+a7a24535a6a70b141ef3f23de6648869d86c5a25:_bmad/_config/files-manifest.csv:generic-api-key:433

scripts/apply-repo-settings.sh

@@ -94,8 +94,6 @@ apply_security_and_analysis() {
   }
 }
 JSON
-  return
-}
 
 # apply_check_suite_prefs <owner/repo>
 # Disables auto-trigger for any configured app that currently has it enabled.

scripts/apply-repo-settings.test.sh

@@ -105,62 +105,48 @@ assert_eq "pr_quality_require_last_push_approval_status: empty string -> missing
   "$MISSING" "$(pr_quality_require_last_push_approval_status "")"
 
 # ── pr_quality_reconcile_payload ──────────────────────────────────────────────
-# A fully-drifted ruleset: multiple merge methods allowed, both review-safety
-# parameters false, plus structural fields and a second (non-pull_request) rule
-# that must pass through untouched.
-ruleset_drifted_full='{
-  "name":"pr-quality",
-  "target":"branch",
-  "enforcement":"active",
-  "bypass_actors":[{"actor_id":1,"actor_type":"Team","bypass_mode":"always"}],
-  "conditions":{"ref_name":{"include":["~DEFAULT_BRANCH"],"exclude":[]}},
-  "rules":[
-    {"type":"pull_request","parameters":{"allowed_merge_methods":["merge","rebase","squash"],"require_last_push_approval":false,"dismiss_stale_reviews_on_push":false}},
-    {"type":"required_status_checks","parameters":{"strict_required_status_checks_policy":true}}
-  ]
-}'
+# A ruleset whose pull_request rule has drifted on every reconciled parameter,
+# alongside a non-pull_request rule and top-level metadata that must survive the
+# transform untouched.
+ruleset_drifted_full='{"name":"pr-quality","target":"branch","enforcement":"active","bypass_actors":[{"actor_id":5,"actor_type":"Team"}],"conditions":{"ref_name":{"include":["~DEFAULT_BRANCH"],"exclude":[]}},"rules":[{"type":"required_status_checks","parameters":{"strict_required_status_checks_policy":true}},{"type":"pull_request","parameters":{"allowed_merge_methods":["merge","rebase","squash"],"require_last_push_approval":false,"dismiss_stale_reviews_on_push":false}}]}'
+
 payload_drifted=""
-payload_drifted="$(pr_quality_reconcile_payload "$ruleset_drifted_full")"
+if ! payload_drifted="$(pr_quality_reconcile_payload "$ruleset_drifted_full")"; then
+  echo "Failed to reconcile payload" >&2
+  exit 1
+fi
 
-assert_eq "pr_quality_reconcile_payload: require_last_push_approval reconciled to true" \
-  "true" "$(printf '%s' "$payload_drifted" | jq -r '.rules[] | select(.type=="pull_request") | .parameters.require_last_push_approval')"
-assert_eq "pr_quality_reconcile_payload: dismiss_stale_reviews_on_push reconciled to true" \
+assert_eq "pr_quality_reconcile_payload: dismiss_stale_reviews_on_push drifted -> true" \
   "true" "$(printf '%s' "$payload_drifted" | jq -r '.rules[] | select(.type=="pull_request") | .parameters.dismiss_stale_reviews_on_push')"
-assert_eq "pr_quality_reconcile_payload: allowed_merge_methods reconciled to squash-only" \
-  '["squash"]' "$(printf '%s' "$payload_drifted" | jq -c '.rules[] | select(.type=="pull_request") | .parameters.allowed_merge_methods')"
-assert_eq "pr_quality_reconcile_payload: preserves ruleset name" \
+assert_eq "pr_quality_reconcile_payload: allowed_merge_methods -> squash-only" \
+  "squash" "$(printf '%s' "$payload_drifted" | jq -r '.rules[] | select(.type=="pull_request") | .parameters.allowed_merge_methods | join(",")')"
+assert_eq "pr_quality_reconcile_payload: require_last_push_approval -> true" \
+  "true" "$(printf '%s' "$payload_drifted" | jq -r '.rules[] | select(.type=="pull_request") | .parameters.require_last_push_approval')"
+assert_eq "pr_quality_reconcile_payload: non-pull_request rule preserved unchanged" \
+  "true" "$(printf '%s' "$payload_drifted" | jq -r '.rules[] | select(.type=="required_status_checks") | .parameters.strict_required_status_checks_policy')"
+assert_eq "pr_quality_reconcile_payload: top-level metadata (name) preserved" \
   "pr-quality" "$(printf '%s' "$payload_drifted" | jq -r '.name')"
-assert_eq "pr_quality_reconcile_payload: preserves target" \
-  "branch" "$(printf '%s' "$payload_drifted" | jq -r '.target')"
-assert_eq "pr_quality_reconcile_payload: preserves enforcement" \
+assert_eq "pr_quality_reconcile_payload: enforcement preserved" \
   "active" "$(printf '%s' "$payload_drifted" | jq -r '.enforcement')"
-assert_eq "pr_quality_reconcile_payload: preserves conditions" \
-  '{"ref_name":{"include":["~DEFAULT_BRANCH"],"exclude":[]}}' \
-  "$(printf '%s' "$payload_drifted" | jq -c '.conditions')"
-assert_eq "pr_quality_reconcile_payload: preserves bypass_actors" \
-  '[{"actor_id":1,"actor_type":"Team","bypass_mode":"always"}]' \
-  "$(printf '%s' "$payload_drifted" | jq -c '.bypass_actors')"
-assert_eq "pr_quality_reconcile_payload: non-pull_request rule passes through untouched" \
-  '{"type":"required_status_checks","parameters":{"strict_required_status_checks_policy":true}}' \
-  "$(printf '%s' "$payload_drifted" | jq -c '.rules[] | select(.type=="required_status_checks")')"
-
-# Ruleset missing bypass_actors and with the pull_request rule's parameters
-# entirely absent: the payload must still add the two review-safety params and
-# default bypass_actors to [].
-ruleset_minimal='{
-  "name":"pr-quality","target":"branch","enforcement":"active",
-  "conditions":{"ref_name":{"include":["~DEFAULT_BRANCH"],"exclude":[]}},
-  "rules":[{"type":"pull_request"}]
-}'
-payload_minimal=""
-payload_minimal="$(pr_quality_reconcile_payload "$ruleset_minimal")"
-
-assert_eq "pr_quality_reconcile_payload: absent bypass_actors defaults to []" \
-  '[]' "$(printf '%s' "$payload_minimal" | jq -c '.bypass_actors')"
-assert_eq "pr_quality_reconcile_payload: adds require_last_push_approval when params absent" \
-  "true" "$(printf '%s' "$payload_minimal" | jq -r '.rules[] | select(.type=="pull_request") | .parameters.require_last_push_approval')"
-assert_eq "pr_quality_reconcile_payload: adds squash-only when params absent" \
-  '["squash"]' "$(printf '%s' "$payload_minimal" | jq -c '.rules[] | select(.type=="pull_request") | .parameters.allowed_merge_methods')"
+assert_eq "pr_quality_reconcile_payload: conditions preserved" \
+  "~DEFAULT_BRANCH" "$(printf '%s' "$payload_drifted" | jq -r '.conditions.ref_name.include[0]')"
+assert_eq "pr_quality_reconcile_payload: bypass_actors preserved" \
+  "5" "$(printf '%s' "$payload_drifted" | jq -r '.bypass_actors[0].actor_id')"
+
+# When the ruleset has no bypass_actors key, the payload defaults it to an empty
+# array (matching apply_pr_quality_ruleset's original behavior).
+ruleset_no_bypass='{"name":"pr-quality","target":"branch","enforcement":"active","conditions":{},"rules":[{"type":"pull_request","parameters":{"dismiss_stale_reviews_on_push":false}}]}'
+assert_eq "pr_quality_reconcile_payload: absent bypass_actors -> empty array" \
+  "0" "$(printf '%s' "$(pr_quality_reconcile_payload "$ruleset_no_bypass")" | jq -r '.bypass_actors | length')"
+assert_eq "pr_quality_reconcile_payload: reconciles dismiss even when parameter absent-defaulted" \
+  "true" "$(printf '%s' "$(pr_quality_reconcile_payload "$ruleset_no_bypass")" | jq -r '.rules[] | select(.type=="pull_request") | .parameters.dismiss_stale_reviews_on_push')"
+
+# Empty input must return a non-zero exit so callers can detect failure.
+if pr_quality_reconcile_payload "" >/dev/null 2>&1; then
+  fail "pr_quality_reconcile_payload: empty input -> non-zero exit"
+else
+  pass "pr_quality_reconcile_payload: empty input -> non-zero exit"
+fi
 
 # ── pr_quality_needs_reconcile ────────────────────────────────────────────────
 # The reconcile decision: given the three parsed parameter statuses, does the