Compliance: dev-lead-stub-agent-ref

[don-petry]

Compliance Finding

Category: ci-workflows
Severity: error
Check: dev-lead-stub-agent-ref

Detail

The dev-lead.yml caller stub must pass with: agent_ref: dev-lead/<channel> (stable, next, or ring<N>) so the reusable checks out its own scripts/prompts from the same channel. Re-sync from standards/workflows/dev-lead.yml.

Standard Reference

standards/ci-standards.md#dev-lead-agent

Remediation

Copy the relevant workflow template from standards/workflows/ verbatim — do not generate from scratch:

gh api repos/petry-projects/.github/contents/standards/workflows/<template>.yml --jq '.content' | base64 -d > .github/workflows/<template>.yml

Available templates: agent-shield.yml, dev-lead.yml, dependabot-automerge.yml, dependabot-rebase.yml, dependency-audit.yml, feature-ideation.yml

---

This issue was automatically created by the weekly compliance audit.

[don-petry]

Dev-Lead: implementation deferred — automation PR queue is full

No pull request was opened for issue #448. The org-wide
open-automation-PR queue is currently at its signed-off cap (see
standards/pr-limits.json in petry-projects/.github).

This issue stays labeled dev-lead and will be re-attempted automatically once
the queue drains — no action is required.

[don-petry]

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Re-sync .github/workflows/dev-lead.yml from the canonical standards/workflows/dev-lead.yml so the caller stub passes with: agent_ref: dev-lead/<channel> matching its uses: channel pin.

Implementation Checklist

• Fetch canonical standards/workflows/dev-lead.yml from petry-projects/.github
• Byte-diff against .github/workflows/dev-lead.yml
• If drift exists, copy the template verbatim; otherwise confirm already in sync
• Verify uses: channel pin and agent_ref: value are consistent

Tests to Write

• N/A — config-only workflow stub with no runtime logic in this repo; no Jest surface. Phase 2 TDD exception (behavior-preserving / already-compliant) noted per prompt.

Test Command

bash ".dev-lead/scripts/dev-lead-lint.sh" (repo lint gate); npm test for the JS suite.

[don-petry]

Dev-Lead: Implementation Complete

Outcome

No code change was required — the workflow is already compliant.

.github/workflows/dev-lead.yml is byte-identical (cmp, 3998/3998 bytes) to the canonical standards/workflows/dev-lead.yml and already passes:

    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
    with:
      agent_ref: dev-lead/stable

The uses: channel pin (dev-lead/stable) and the agent_ref value (dev-lead/stable) are consistent, satisfying the dev-lead-stub-agent-ref check. Re-applying the remediation (gh api ... | base64 -d > .github/workflows/dev-lead.yml) verbatim produced a zero-line diff.

The audit that filed #448 appears to have run against an older state of the default branch; this branch's base commit already carries the synced stub.

Plan Execution

• Fetched canonical standards/workflows/dev-lead.yml
• Byte-diffed against the repo copy — identical (cmp byte-exact, no CRLF, matching trailing newline)
• Re-applied the verbatim template copy — zero diff
• Verified uses: channel pin and agent_ref: are consistent (dev-lead/stable)

Test Results

Phase 2 TDD exception: config-only workflow stub with no repo-side runtime logic and no Jest surface — behavior-preserving / already-compliant, so no new failing test applies. Full suite and lint gates run for verification:

[lint] shellcheck on 4 file(s)...
[lint] validating CODEOWNERS...
OK: CODEOWNERS
[lint] all checks passed

Test Suites: 12 passed, 12 total
Tests:       301 passed, 301 total
Snapshots:   0 total
Time:        4.795 s

npm run check → 0 errors, 22 pre-existing warnings (unused vars in untouched test files), exit 0

Files Changed

• None. .github/workflows/dev-lead.yml verified in sync; working tree clean.

Notes

No behavioral change. If the compliance audit does not auto-resolve #448 on its next run against current main, this can be closed manually — the standard is satisfied. No follow-up issues needed.

[don-petry]

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Verify the dev-lead.yml caller stub passes with: agent_ref: dev-lead/<channel> matching its uses: channel pin, re-syncing verbatim from standards/workflows/dev-lead.yml if it drifts.

Investigation Checklist

• Fetch canonical standards/workflows/dev-lead.yml from petry-projects/.github
• Byte-compare against local .github/workflows/dev-lead.yml
• Confirm with: agent_ref: dev-lead/stable is present and matches the uses: @dev-lead/stable channel pin
• Confirm no other dev-lead caller stub exists in the repo
• Run .dev-lead/scripts/dev-lead-lint.sh and repo lint/format/test to confirm repo health

Tests to Write

• N/A — this is a CI-workflow / configuration compliance finding with no application code and no observable runtime behavior to unit-test (Phase 2 TDD exception per the dev-lead template).

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh (workflow lint) + npm run check + npm test (repo health)

Preliminary Finding

The local stub already appears identical to the canonical template with agent_ref: dev-lead/stable present. Confirming below before reporting.

[don-petry]

Dev-Lead: Implementation Complete — No Change Required (already compliant)

Finding

The dev-lead-stub-agent-ref check requires .github/workflows/dev-lead.yml to pass with: agent_ref: dev-lead/<channel> matching its uses: channel pin. The stub already satisfies this and is byte-for-byte identical to the canonical standards/workflows/dev-lead.yml.

Verification

• Canonical fetch vs local diff: identical, 0 bytes of difference.

  $ diff <(gh api .../standards/workflows/dev-lead.yml | base64 -d) .github/workflows/dev-lead.yml
  === IDENTICAL (content) ===
  Canonical bytes: 3998
  Local bytes:     3998
  

• agent_ref present and channel-matched (.github/workflows/dev-lead.yml):

  64:    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
  66:      agent_ref: dev-lead/stable
  

  uses: channel (@dev-lead/stable) and with: agent_ref (dev-lead/stable) match.
• Sole caller stub: grep confirms dev-lead.yml is the only file referencing dev-lead-reusable.yml.
• Already on main: both HEAD and origin/main are at 6c0a7da; the agent_ref line was introduced by the Compliance: non-stub-feature-ideation.yml #414 / feat: implement issue #414 — Compliance: non-stub-feature-ideation.yml #441 PR (merged 2026-07-17), which re-synced this stub to the canonical template. That PR resolved this finding; the weekly audit that opened Compliance: dev-lead-stub-agent-ref #448 ran against a pre-feat: implement issue #414 — Compliance: non-stub-feature-ideation.yml #441 state.

Test / Lint Results

$ bash .dev-lead/scripts/dev-lead-lint.sh
[lint] shellcheck on 4 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed   (exit 0)

$ git diff HEAD --stat
(empty — no files changed)

Phase 2 (TDD) skipped per the template exception: pure CI-workflow/config compliance with no application code or observable runtime behavior to unit-test. npm run check was not runnable here (dev dependencies/prettier not installed in this environment), but this is moot — zero files were changed, so there is nothing to format or lint.

Files Changed

• None. The stub already matches the canonical template verbatim.

Notes

No source change is required to satisfy dev-lead-stub-agent-ref; the finding is already remediated on main. Since the working tree is clean, no commit/PR will be produced by CI for this branch. Recommend closing #448 as already-resolved (superseded by #441), or re-running the compliance audit against current main to auto-clear it.

[don-petry]

Dev-Lead Implementation Plan

Issue: #448 — Compliance: dev-lead-stub-agent-ref

Scope

Re-sync .github/workflows/dev-lead.yml from the canonical standards/workflows/dev-lead.yml so the caller stub passes with: agent_ref: dev-lead/<channel> matching its uses: channel pin.

Implementation Checklist

• Fetch canonical standards/workflows/dev-lead.yml from petry-projects/.github
• Diff against local .github/workflows/dev-lead.yml
• Apply verbatim copy if drift is present

Tests to Write

• N/A — workflow YAML config change, no unit-testable logic (Phase 2 config exception per prompt)

Test Command

bash ".dev-lead/scripts/dev-lead-lint.sh" (plus repo npm run check / npm test for regression safety)

Initial Finding

Local dev-lead.yml is currently byte-for-byte identical to the canonical template (3998 bytes, diff clean) and already contains with: agent_ref: dev-lead/stable matching the @dev-lead/stable uses: pin. Re-running the remediation gh api … | base64 -d sync produces no diff. Proceeding to verify lint/tests and will report accordingly.

[don-petry]

Dev-Lead: Implementation Complete

Outcome: already compliant — no source change required

The compliance finding is already satisfied in the current codebase. .github/workflows/dev-lead.yml is byte-for-byte identical to the canonical standards/workflows/dev-lead.yml and already passes the required input:

  dev-lead:
    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable  # NOSONAR(githubactions:S7637) first-party channel ref
    with:
      agent_ref: dev-lead/stable
    secrets: inherit

agent_ref: dev-lead/stable matches the @dev-lead/stable channel pin on the uses: ref, so the reusable checks out its own scripts/prompts from the same channel — exactly what check dev-lead-stub-agent-ref requires.

Plan Execution

• Fetched canonical standards/workflows/dev-lead.yml via gh api … | base64 -d
• Diffed against local stub — 0 differences (both 3998 bytes)
• Re-ran the remediation sync command verbatim — produced no diff (git status clean)
• Verified the stub carries with: agent_ref: dev-lead/stable matching its uses: pin

Why the finding was flagged

Commit 6c0a7da (issue #414, merged 2026-07-17) added dev-lead.yml already in its correct, agent_ref-bearing form. The audit that opened this issue appears to predate that commit (or ran against an older snapshot); the drift it describes is not present on the current branch/main.

Test Results

No unit-testable logic changed (workflow YAML config — Phase 2 config exception). Verification checks run for repo health:

$ bash .dev-lead/scripts/dev-lead-lint.sh
  [lint] shellcheck on 4 file(s)...
  [lint] validating CODEOWNERS...
OK: CODEOWNERS
  [lint] all checks passed        (exit 0)

$ npm run check
prettier --check .  → pass
eslint              → 0 errors, 22 pre-existing warnings (untouched test files)

$ git status --short
(clean — no files modified)

Files Changed

• None. .github/workflows/dev-lead.yml already matches the canonical template verbatim.

Notes

No code change was made because none was warranted — fabricating a no-op diff would be drift, not remediation. This issue can be closed as already-resolved. If the compliance audit re-runs against current main, it should no longer flag dev-lead-stub-agent-ref.