From 1e8a6c9c82be367abf7fa858a7288c99a02540c9 Mon Sep 17 00:00:00 2001
From: donpetry-bot <{}+donpetry-bot@users.noreply.github.com>
Date: Wed, 1 Jul 2026 11:34:42 -0500
Subject: [PATCH 1/2] fix(rulesets): add Secret scan (gitleaks) + coverage to
 code-quality (#966)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The codified code-quality ruleset enforced only SonarCloud, CodeQL,
agent-shield/AgentShield, and dependency-audit/Detect ecosystems — diverging from
the documented standard (github-settings.md §243), which also lists Secret Scan
and Coverage. Now that the template ci.yml produces both checks (companion
petry-projects/.github#569: gitleaks secret-scan job + stack-aware coverage job),
add the two contexts so the enforced ruleset matches the docs and the template.

Enables rulesets-by-default on repo-template: all six contexts
(SonarCloud, CodeQL, AgentShield, dependency-audit/Detect ecosystems,
Secret scan (gitleaks), coverage) are produced by the seeded scaffold + CodeQL
default-setup, so code-quality can be applied without bricking a fresh repo.

Refs #966, epic #964.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/rulesets/code-quality.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/rulesets/code-quality.json b/.github/rulesets/code-quality.json
index d64cb211b..b0aef39e2 100644
--- a/.github/rulesets/code-quality.json
+++ b/.github/rulesets/code-quality.json
@@ -27,7 +27,9 @@
           {"context": "SonarCloud"},
           {"context": "CodeQL"},
           {"context": "agent-shield / AgentShield"},
-          {"context": "dependency-audit / Detect ecosystems"}
+          {"context": "dependency-audit / Detect ecosystems"},
+          {"context": "Secret scan (gitleaks)"},
+          {"context": "coverage"}
         ],
         "strict_required_status_checks_policy": true,
         "do_not_enforce_on_create": false

From fe9f358e9d0d77c88c1dbf8e83c35fef5b567309 Mon Sep 17 00:00:00 2001
From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Date: Wed, 1 Jul 2026 19:39:03 +0000
Subject: [PATCH 2/2] fix(reviews): address review comments [skip ci-relay]

---
 .github/workflows/ci.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce10a02ba..209e636e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -139,3 +139,23 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+
+  coverage:
+    name: coverage
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Install dependencies
+        run: pip install --quiet pyyaml
+
+      - name: Run Python integration tests
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          python tests/dev-lead/integration/test_workflow_toplevel_permissions.py
+          python tests/dev-lead/integration/test_auto_rebase_stub.py
+          python tests/dev-lead/integration/test_dependency_audit_stub.py
+          python tests/dev-lead/integration/test_caller_permissions.py