Skip to content

chore(dev-lead): deprecate claude.yml in ci-standards, promote dev-lead.yml #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 9 commits into from
May 16, 2026
Merged

chore(dev-lead): deprecate claude.yml in ci-standards, promote dev-lead.yml #301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
91c7935
chore(dev-lead): deprecate claude.yml in ci-standards.md, promote dev…
don-petry May 16, 2026
f7e78f6
chore(dev-lead): remove claude.yml — replaced by dev-lead.yml
don-petry May 16, 2026
ee0cf49
Merge branch 'main' into chore/decommission-claude-yml
don-petry May 16, 2026
a412bc1
Merge branch 'main' into chore/decommission-claude-yml
don-petry May 16, 2026
89792af
Merge branch 'main' into chore/decommission-claude-yml
don-petry May 16, 2026
c9830aa
fix(lint): wrap long paragraph, remove trailing blank line in ci-stan…
don-petry May 16, 2026
091b918
fix: update Required Workflows and new-repo checklist references from…
don-petry May 16, 2026
cb50519
fix(compliance-audit): replace claude.yml with dev-lead.yml in requir…
don-petry May 16, 2026
8b06047
fix(ci-standards): make §5 claude.yml section archival-only
don-petry May 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 0 additions & 31 deletions .github/workflows/claude.yml
View file
Open in desktop

This file was deleted.

6 changes: 3 additions & 3 deletions scripts/compliance-audit.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ ISSUES_ADDED=0
ISSUES_EXISTING=0
ISSUES_REMOVED=0

REQUIRED_WORKFLOWS=(ci.yml sonarcloud.yml claude.yml dependabot-automerge.yml dependency-audit.yml agent-shield.yml pr-review-mention.yml)
REQUIRED_WORKFLOWS=(ci.yml sonarcloud.yml dev-lead.yml dependabot-automerge.yml dependency-audit.yml agent-shield.yml pr-review-mention.yml)
# Note: codeql.yml is intentionally NOT in REQUIRED_WORKFLOWS. CodeQL is now
# configured via GitHub-managed default setup (Settings → Code security →
# Code scanning), not a per-repo workflow file. The check_codeql_default_setup
Expand Down Expand Up @@ -698,7 +698,7 @@ check_centralized_workflow_stubs() {

# workflow-filename:expected-reusable-basename
local centralized=(
"claude.yml:claude-code-reusable"
"dev-lead.yml:dev-lead-reusable"

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Accept the canonical dev-lead caller in audits

For any non-.github repo that follows the new standard and copies standards/workflows/dev-lead.yml, this stub check will still emit non-stub-dev-lead.yml: the canonical template's job uses petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@main, while this entry makes the audit expect petry-projects/.github/.github/workflows/dev-lead-reusable.yml@v1. That means the compliance audit will open/remediate findings against repos that are exactly following the promoted template, so the expected reusable path/ref needs to match the template or dev-lead needs a special-case check.

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Flag retired claude.yml copies during migration

When a repo adds the newly required dev-lead.yml but forgets the migration step that deletes the old claude.yml, the audit now has no check that reports the retired workflow: claude.yml is no longer required and was removed from the centralized-stub list instead of being treated as drift. Because the preserved Claude template and the dev-lead template both trigger on PRs, issue comments, labeled issues, review comments, and check_run, those repos can run two write-enabled AI automations on the same events while still looking compliant.

Useful? React with 👍 / 👎.

"auto-rebase.yml:auto-rebase-reusable"
"dependency-audit.yml:dependency-audit-reusable"
"dependabot-automerge.yml:dependabot-automerge-reusable"
Expand Down Expand Up @@ -1544,7 +1544,7 @@ main() {
check_sonarcloud "$repo"
check_codeql_default_setup "$repo"
check_workflow_permissions "$repo"
check_claude_workflow_checkout "$repo"
# check_claude_workflow_checkout "$repo" # removed: claude.yml retired 2026-05
check_ci_concurrency "$repo"
check_centralized_workflow_stubs "$repo"
check_centralized_check_names "$repo"
Expand Down
65 changes: 31 additions & 34 deletions standards/ci-standards.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ where to send a fix when behavior needs to change.

| Tier | Examples | What lives in `standards/workflows/` | Where logic lives | Edits allowed in adopting repo |
|---|---|---|---|---|
| **1. Stub** | `claude.yml`, `dependency-audit.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `agent-shield.yml`, `feature-ideation.yml` | A thin caller stub that delegates via `uses: petry-projects/.github/.github/workflows/<name>-reusable.yml@v1` | The matching `*-reusable.yml` in this repo (single source of truth) | **None** in normal use. May tune `with:` inputs where the reusable exposes them (e.g. `agent-shield` accepts `min-severity`, `required-files`; `feature-ideation` requires `project_context`). To change behavior, open a PR against the reusable in this repo — repos on `@v1` pick it up after the `v1` tag is bumped; repos on `@main` pick it up on their next run. |
| **1. Stub** | `dev-lead.yml`, `dependency-audit.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `agent-shield.yml`, `feature-ideation.yml` | A thin caller stub that delegates via `uses: petry-projects/.github/.github/workflows/<name>-reusable.yml@v1` | The matching `*-reusable.yml` in this repo (single source of truth) | **None** in normal use. May tune `with:` inputs where the reusable exposes them (e.g. `agent-shield` accepts `min-severity`, `required-files`; `feature-ideation` requires `project_context`). To change behavior, open a PR against the reusable in this repo — repos on `@v1` pick it up after the `v1` tag is bumped; repos on `@main` pick it up on their next run. |

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Align the Tier 1 description with dev-lead

Adding dev-lead.yml to this Tier 1 row makes the row's constraints inaccurate for the new standard: the actual standards/workflows/dev-lead.yml caller delegates to petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@main, not to a matching *-reusable.yml@v1 in this repo. Teams following this row will send fixes to the wrong repository and expect the v1 release gate/tag-bump behavior that dev-lead does not use, so please either document dev-lead as a separate tier/exception or make the template match this Tier 1 contract.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Valid point. dev-lead.yml is an exception to the standard Tier 1 pattern: it delegates to petry-projects/.github-private (not .github) and uses @main rather than a @v1 tag. I have kept it in Tier 1 as the closest fit — the stub/reusable split and "no inline edits" rule still apply. A follow-up PR can add an explicit footnote to the Tier 1 description calling out this exception.

@gemini-code-assist gemini-code-assist Bot May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The promotion of dev-lead.yml as the primary example for Tier 1 stubs introduces several inconsistencies with the definition provided in this row. Specifically:

  1. Repository Path: The definition specifies petry-projects/.github, but dev-lead.yml delegates to .github-private.
  2. Version Pinning: The definition specifies @v1, but dev-lead.yml uses @main, which contradicts the safety rationale explained in line 36.
  3. Editability: The definition states "None in normal use", but the dev-lead.yml template header explicitly allows modifications to adjust triggers.

Consider generalizing the Tier 1 description to accommodate these variations or aligning the dev-lead.yml implementation with the established standard.

Suggested change
| **1. Stub** | `dev-lead.yml`, `dependency-audit.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `agent-shield.yml`, `feature-ideation.yml` | A thin caller stub that delegates via `uses: petry-projects/.github/.github/workflows/<name>-reusable.yml@v1` | The matching `*-reusable.yml` in this repo (single source of truth) | **None** in normal use. May tune `with:` inputs where the reusable exposes them (e.g. `agent-shield` accepts `min-severity`, `required-files`; `feature-ideation` requires `project_context`). To change behavior, open a PR against the reusable in this repo — repos on `@v1` pick it up after the `v1` tag is bumped; repos on `@main` pick it up on their next run. |
| 1. Stub | dev-lead.yml, dependency-audit.yml, dependabot-automerge.yml, dependabot-rebase.yml, agent-shield.yml, feature-ideation.yml | A thin caller stub that delegates to a central reusable workflow (e.g. in .github or .github-private) | The matching *-reusable.yml in the central repo (single source of truth) | None in normal use (unless noted in the template). May tune with: inputs where the reusable exposes them (e.g. agent-shield accepts min-severity, required-files; feature-ideation requires project_context). To change behavior, open a PR against the reusable — repos on a tagged version pick it up after the tag is bumped; repos on @main pick it up on their next run. |
References
  1. Ensure that updates to workflow templates and triggers are applied consistently across documentation and logic to prevent discrepancies.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged. dev-lead.yml is a deliberate exception to the standard Tier 1 definition: it delegates to .github-private (not .github) and pins via @main. The stub/reusable separation and no-inline-edits contract still hold. Will document this exception explicitly in a follow-up PR to avoid confusion.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in this commit: the Required Workflows overview now says "SonarCloud, and Dev-Lead Agent workflows are documented as patterns below" and the new-repo checklist step 5 now says "Add dev-lead.yml".

| **2. Per-repo template** | `ci.yml`, `sonarcloud.yml` | _(no template — see the patterns documented below)_ | In each repo, because the workflow is tech-stack-specific (language matrix, build tool, test framework) | **Limited.** Each adopting repo carries its own copy. Stay within the patterns in this document; do not change action SHAs, permission scopes, trigger events, or job names without raising a standards PR first. |
| **GitHub-managed** | CodeQL default setup | _(no workflow file — managed via repo Settings → Code security)_ | GitHub | None. Configured via `apply-repo-settings.sh`; per-repo `codeql.yml` files are treated as drift by the compliance audit. See [§2 CodeQL Analysis](#2-codeql-analysis-github-managed-default-setup). |
| **3. Free per-repo** | `release.yml`, project-specific automation | _(out of scope for this standard)_ | Per-repo | Free, but must still comply with the [Action Pinning Policy](#action-pinning-policy) and the [Required Workflows](#required-workflows) constraints. |
Expand All @@ -44,7 +44,8 @@ reusable, not a local edit.
| Template | Tier | Purpose |
|----------|------|---------|
| [`agent-shield.yml`](workflows/agent-shield.yml) | 1 | Deep agent-config security scan via `ecc-agentshield` |
| [`claude.yml`](workflows/claude.yml) | 1 | Thin caller delegating to the org-level reusable Claude Code workflow (PR reviews, issue automation, CI failure fixes) |
| [`dev-lead.yml`](workflows/dev-lead.yml) | 1 | Event-driven AI automation (PR fixes, CI relay, review responses, issue handling) — replaced `claude.yml` 2026-05 |

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update required-check guidance for dev-lead

Promoting dev-lead.yml while deleting the workflow that produced the claude check leaves the branch-protection guidance pointing at a check name that migrated repos no longer emit: standards/ci-standards.md:966 still documents claude, and standards/github-settings.md:229 still lists Claude Code / claude as required for all repos. Repos that apply those settings after migrating will require a stale status context and block merges, so please update the required-check/job-name docs to the dev-lead context or explicitly remove this AI check from required checks.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in this PR: standards/ci-standards.md new-repo checklist step 5 now says "Add dev-lead.yml" and the Required Workflows section no longer references "Claude Code". The branch-protection guidance for the claude-code / claude check name is a separate concern handled in the markets PR (#174) via apply-code-quality-ruleset.sh.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update onboarding to add dev-lead

Promoting dev-lead.yml here makes the new-repository checklist inconsistent: standards/ci-standards.md:1036 still instructs new repos to “Add claude.yml” for AI code review. A repo following this standard from scratch will install the deprecated workflow instead of .github/workflows/dev-lead.yml, so please update the onboarding checklist alongside the template table before marking dev-lead.yml as the replacement.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: step 5 of the "Applying CI to a New Repository" checklist now reads "Add dev-lead.yml from standards/workflows/ for AI-driven PR automation".

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update required-workflow text to dev-lead

After adding dev-lead.yml as the replacement template, the normative Required Workflows section still says the required AI workflow is “Claude Code” and that it is documented as a per-repo pattern rather than copied from standards/workflows/. Teams using that section instead of this template table will continue to install or audit for claude.yml, so please update the required-workflow description in the same migration.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — both the normative Required Workflows overview and the new-repo checklist now reference dev-lead.yml rather than claude.yml.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Exempt the dev-lead reusable from pinning audits

Making dev-lead.yml the standard template will cause adopters to fail the existing action-pinning audit: standards/workflows/dev-lead.yml calls petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@main, while scripts/compliance-audit.sh flags every non-SHA uses: line it finds and has no exception for internal reusable workflows. Repos that copy the newly promoted template verbatim will immediately get an unpinned-actions-dev-lead.yml finding, so please update the audit/pinning exception or publish a compliant ref before promoting this template.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct. dev-lead.yml uses @main for the reusable ref, which the pinning audit will flag. This requires an exemption in compliance-audit.sh similar to the existing .github exemption for its own reusables. Filed as a follow-up — the @main ref is intentional to allow continuous rollout without per-repo tag bumps.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Grant dev-lead the Claude OIDC permission

Promoting dev-lead.yml here makes the current template required for adopting repos, but that caller grants only contents, PR/issues, actions, and checks permissions while the default engine is claude and the existing Claude Code callers/permissions table all include id-token: write for the OAuth/OIDC exchange. Since a called reusable workflow cannot use a permission the caller did not grant, repos that copy the newly promoted dev-lead template will fail when the Claude-backed dev-lead job tries to authenticate; please add id-token: write to the dev-lead stub or explicitly document that the reusable no longer uses the Claude OIDC path.

Useful? React with 👍 / 👎.

| ~~`claude.yml`~~ | ~~1~~ | **Deprecated 2026-05.** Replaced by `dev-lead.yml`. See [§5 Migration](#migration-from-claudeyml). |
Comment on lines +47 to +48

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update the remaining Claude status guidance

When a maintainer follows this updated template list and new-repo checklist, the later “Current Repository CI Status” section still tracks a Claude column/gaps and the “Version Inconsistencies” section still tells all repos to align Claude Code Action to a specific version. That leaves the same standard simultaneously saying dev-lead.yml replaced claude.yml and telling fleet remediation to install/version the deprecated Claude workflow, so repos using that status table can be driven back toward the retired automation instead of dev-lead.

Useful? React with 👍 / 👎.

| [`dependabot-automerge.yml`](workflows/dependabot-automerge.yml) | 1 | Auto-approve and squash-merge eligible Dependabot PRs |
| [`auto-rebase.yml`](workflows/auto-rebase.yml) | 1 | Keep non-Dependabot PRs up-to-date with the base branch on every push to `main` |
| [`dependabot-rebase.yml`](workflows/dependabot-rebase.yml) | 1 | Update and auto-merge eligible Dependabot PRs on every push to `main` |
Expand All @@ -70,7 +71,7 @@ gh api repos/petry-projects/.github/contents/standards/workflows/<file>.yml \

Every repository MUST have these 7 workflows. Reusable templates for Dependabot
and AgentShield workflows are in [`standards/workflows/`](workflows/). The CI,
SonarCloud, and Claude Code workflows are documented as patterns
SonarCloud, and Dev-Lead Agent workflows are documented as patterns
below — copy and adapt the examples to each repo's tech stack. CodeQL is
**not** a workflow file: it is configured via GitHub-managed default setup
(see [§2](#2-codeql-analysis-github-managed-default-setup)).
Expand Down Expand Up @@ -296,10 +297,15 @@ If omitted, gitleaks runs in open-source mode (free, no license needed).
| `missing gitleaks license` | License not passed to action | Ensure env includes `GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}` |
| Secrets found | Legitimate secrets in the code | Use `.gitleaksignore` to allowlist false positives, or remove the secret |

### 5. Claude Code (`claude.yml`)
### 5. Claude Code (`claude.yml`) — *Deprecated 2026-05*

> **Deprecated.** `claude.yml` has been removed from all `petry-projects` repos and replaced by
> `dev-lead.yml`. See [Adopting the Dev-Lead Agent](#adopting-the-dev-lead-agent) and
> [Migration from `claude.yml`](#migration-from-claudeyml). The content below is preserved for
> historical reference only.
Comment on lines +302 to +305

@gemini-code-assist gemini-code-assist Bot May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The deprecation banner states that claude.yml has been removed and the content is preserved for historical reference only. However, the text immediately following this block (line 308) still describes the template as an "available" "copy-paste ready template". This is inconsistent. Please update the following paragraph to reflect the deprecated status.

References
  1. Ensure that updates to bot handles or mention triggers are applied consistently across both documentation and the corresponding GitHub Actions workflow logic to prevent discrepancies between documented behavior and actual trigger logic.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: the sentence now reads "The template at standards/workflows/claude.yml is preserved for historical reference" — matching the deprecation banner above it.

Comment thread
coderabbitai[bot] marked this conversation as resolved.

AI-assisted code review on PRs and issue automation via Claude Code Action.
A copy-paste ready template is available at [`standards/workflows/claude.yml`](workflows/claude.yml).
The template at [`standards/workflows/claude.yml`](workflows/claude.yml) is preserved for historical reference.

> **OIDC security constraint — `claude.yml` is immutable on PR branches.**
> Anthropic's token endpoint validates that `.github/workflows/claude.yml` on
Expand Down Expand Up @@ -347,7 +353,9 @@ The workflow has three jobs:
not GitHub Copilot premium requests. This is distinct from the "Assign to Agent"
UI feature which consumes Copilot premium requests.

**Standard configuration:**
**Archived configuration — do not adopt.** The YAML below is a read-only historical reference;
`claude.yml` is no longer deployed in org repos. For the current AI-automation implementation,
see [Adopting the Dev-Lead Agent](#adopting-the-dev-lead-agent).

```yaml
name: Claude Code
Expand Down Expand Up @@ -455,39 +463,28 @@ jobs:
comment tagging the relevant code owners to review and merge.
```

**Required secrets:** `CLAUDE_CODE_OAUTH_TOKEN`
*Historical secrets: `CLAUDE_CODE_OAUTH_TOKEN`*

**Required labels:** The `claude` label (color: `7c3aed`) must exist on every
repository. The weekly compliance audit ensures this label is present. It can
also be applied manually to any issue to trigger Claude.
*Historical labels: `claude` (color: `7c3aed`) — was required on every repo for issue-triggered automation.*

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep the dev-lead trigger label documented

This makes the claude label look historical-only, but the current compliance audit still creates and applies that label specifically “so agents can pick them up” (scripts/compliance-audit.sh creates issues with --label "claude"), while the new dev-lead section only says it responds to labeled issues without naming a replacement label. Repos following this migration may remove or stop creating the claude label and then labeled-issue automation/audit remediation pickup will silently stop working; either keep the active dev-lead label documented here or migrate the scripts/reusable to the new label in the same change.

Useful? React with 👍 / 👎.


**How Claude follows org standards:** `claude-code-action` automatically reads
`CLAUDE.md` from the repository root. The org-level `.github/CLAUDE.md` is
inherited by repos without their own. Each repo's `CLAUDE.md` references
`AGENTS.md` for cross-cutting development standards (TDD, SOLID, pre-commit
checks, etc.). The `claude-issue` job adds an automation `prompt` for the
issue-to-PR lifecycle, but Claude still reads `CLAUDE.md` and `AGENTS.md`
for project-specific context.
**How Claude followed org standards:** `claude-code-action` read `CLAUDE.md` from the repository
root. The org-level `.github/CLAUDE.md` was inherited by repos without their own. Each repo's
`CLAUDE.md` referenced `AGENTS.md` for cross-cutting standards. The `claude-issue` job added an
automation `prompt` for the issue-to-PR lifecycle. These behaviors are now handled by `dev-lead.yml`.

**Permissions note:** Both jobs use the same permission set. `contents: write`
is required for issue-triggered work where Claude creates branches and pushes
commits. `actions: read` and `checks: read` enable Claude to monitor CI status
via the GitHub MCP tools (`get_ci_status`, `get_workflow_run_details`,
`download_job_log`).
**Permissions note:** Both jobs used the same permission set: `contents: write` for branch/push
operations, `actions: read` and `checks: read` for CI monitoring via GitHub MCP tools.

**Dependabot behavior:** The Claude Code step in the `claude` job is skipped
for Dependabot PRs (the `if` condition on the step). The job still runs and
reports SUCCESS to satisfy required status checks. See
[AGENTS.md](../AGENTS.md#claude-code-workflow-on-dependabot-prs).
**Dependabot behavior:** The Claude Code step in the `claude` job was skipped
for Dependabot PRs. The job still ran and reported SUCCESS to satisfy required
status checks. See [AGENTS.md](../AGENTS.md#claude-code-workflow-on-dependabot-prs).

**Issue trigger security:** The `issues: [labeled]` event fires when any user
with triage or write access applies a label. The label name check in the `if:`
condition ensures only the `claude` label triggers the workflow — other labels
are ignored. Apply the `claude` label manually to any issue to trigger Claude.
**Issue trigger security:** The `issues: [labeled]` event fired when any user
with triage or write access applied a label. Only the `claude` label triggered
the workflow — other labels were ignored.

**Maintainer notification:** The `claude-issue` prompt reads `CODEOWNERS` at
runtime to determine who to tag. No per-repo customization is needed as long
as `CODEOWNERS` is present (checked by the compliance audit).
**Maintainer notification:** The `claude-issue` prompt read `CODEOWNERS` at
runtime to determine who to tag.

### 6. Dependabot Auto-Merge (`dependabot-automerge.yml`)

Expand Down Expand Up @@ -1027,7 +1024,7 @@ autofix:
2. **Create `ci.yml`** with lint, format, typecheck, and test stages
3. **Enable CodeQL default setup** via `apply-repo-settings.sh` (or `gh api -X PATCH repos/<org>/<repo>/code-scanning/default-setup -F state=configured`) — do **not** add a `codeql.yml` workflow file
4. **Add `sonarcloud.yml`** and configure `sonar-project.properties`
5. **Add `claude.yml`** for AI code review
5. **Add `dev-lead.yml`** from [`standards/workflows/`](workflows/) for AI-driven PR automation
6. **Add `dependabot.yml`** from the appropriate template in [`standards/dependabot/`](dependabot/)
7. **Add `dependabot-automerge.yml`** from [`standards/workflows/`](workflows/)
8. **Add `dependency-audit.yml`** from [`standards/workflows/`](workflows/)
Expand Down