Skip to content

chore(dev-lead): deprecate claude.yml in ci-standards, promote dev-lead.yml #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 9 commits into from
May 16, 2026
Merged

chore(dev-lead): deprecate claude.yml in ci-standards, promote dev-lead.yml #301

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
91c7935
chore(dev-lead): deprecate claude.yml in ci-standards.md, promote dev…
don-petry May 16, 2026
f7e78f6
chore(dev-lead): remove claude.yml — replaced by dev-lead.yml
don-petry May 16, 2026
ee0cf49
Merge branch 'main' into chore/decommission-claude-yml
don-petry May 16, 2026
a412bc1
Merge branch 'main' into chore/decommission-claude-yml
don-petry May 16, 2026
89792af
Merge branch 'main' into chore/decommission-claude-yml
don-petry May 16, 2026
c9830aa
fix(lint): wrap long paragraph, remove trailing blank line in ci-stan…
don-petry May 16, 2026
091b918
fix: update Required Workflows and new-repo checklist references from…
don-petry May 16, 2026
cb50519
fix(compliance-audit): replace claude.yml with dev-lead.yml in requir…
don-petry May 16, 2026
8b06047
fix(ci-standards): make §5 claude.yml section archival-only
don-petry May 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 0 additions & 31 deletions .github/workflows/claude.yml
View file
Open in desktop

This file was deleted.

12 changes: 9 additions & 3 deletions standards/ci-standards.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ where to send a fix when behavior needs to change.

| Tier | Examples | What lives in `standards/workflows/` | Where logic lives | Edits allowed in adopting repo |
|---|---|---|---|---|
| **1. Stub** | `claude.yml`, `dependency-audit.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `agent-shield.yml`, `feature-ideation.yml` | A thin caller stub that delegates via `uses: petry-projects/.github/.github/workflows/<name>-reusable.yml@v1` | The matching `*-reusable.yml` in this repo (single source of truth) | **None** in normal use. May tune `with:` inputs where the reusable exposes them (e.g. `agent-shield` accepts `min-severity`, `required-files`; `feature-ideation` requires `project_context`). To change behavior, open a PR against the reusable in this repo — repos on `@v1` pick it up after the `v1` tag is bumped; repos on `@main` pick it up on their next run. |
| **1. Stub** | `dev-lead.yml`, `dependency-audit.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `agent-shield.yml`, `feature-ideation.yml` | A thin caller stub that delegates via `uses: petry-projects/.github/.github/workflows/<name>-reusable.yml@v1` | The matching `*-reusable.yml` in this repo (single source of truth) | **None** in normal use. May tune `with:` inputs where the reusable exposes them (e.g. `agent-shield` accepts `min-severity`, `required-files`; `feature-ideation` requires `project_context`). To change behavior, open a PR against the reusable in this repo — repos on `@v1` pick it up after the `v1` tag is bumped; repos on `@main` pick it up on their next run. |

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Align the Tier 1 description with dev-lead

Adding dev-lead.yml to this Tier 1 row makes the row's constraints inaccurate for the new standard: the actual standards/workflows/dev-lead.yml caller delegates to petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@main, not to a matching *-reusable.yml@v1 in this repo. Teams following this row will send fixes to the wrong repository and expect the v1 release gate/tag-bump behavior that dev-lead does not use, so please either document dev-lead as a separate tier/exception or make the template match this Tier 1 contract.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Valid point. dev-lead.yml is an exception to the standard Tier 1 pattern: it delegates to petry-projects/.github-private (not .github) and uses @main rather than a @v1 tag. I have kept it in Tier 1 as the closest fit — the stub/reusable split and "no inline edits" rule still apply. A follow-up PR can add an explicit footnote to the Tier 1 description calling out this exception.

@gemini-code-assist gemini-code-assist Bot May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The promotion of dev-lead.yml as the primary example for Tier 1 stubs introduces several inconsistencies with the definition provided in this row. Specifically:

  1. Repository Path: The definition specifies petry-projects/.github, but dev-lead.yml delegates to .github-private.
  2. Version Pinning: The definition specifies @v1, but dev-lead.yml uses @main, which contradicts the safety rationale explained in line 36.
  3. Editability: The definition states "None in normal use", but the dev-lead.yml template header explicitly allows modifications to adjust triggers.

Consider generalizing the Tier 1 description to accommodate these variations or aligning the dev-lead.yml implementation with the established standard.

Suggested change
| **1. Stub** | `dev-lead.yml`, `dependency-audit.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `agent-shield.yml`, `feature-ideation.yml` | A thin caller stub that delegates via `uses: petry-projects/.github/.github/workflows/<name>-reusable.yml@v1` | The matching `*-reusable.yml` in this repo (single source of truth) | **None** in normal use. May tune `with:` inputs where the reusable exposes them (e.g. `agent-shield` accepts `min-severity`, `required-files`; `feature-ideation` requires `project_context`). To change behavior, open a PR against the reusable in this repo — repos on `@v1` pick it up after the `v1` tag is bumped; repos on `@main` pick it up on their next run. |
| 1. Stub | dev-lead.yml, dependency-audit.yml, dependabot-automerge.yml, dependabot-rebase.yml, agent-shield.yml, feature-ideation.yml | A thin caller stub that delegates to a central reusable workflow (e.g. in .github or .github-private) | The matching *-reusable.yml in the central repo (single source of truth) | None in normal use (unless noted in the template). May tune with: inputs where the reusable exposes them (e.g. agent-shield accepts min-severity, required-files; feature-ideation requires project_context). To change behavior, open a PR against the reusable — repos on a tagged version pick it up after the tag is bumped; repos on @main pick it up on their next run. |
References
  1. Ensure that updates to workflow templates and triggers are applied consistently across documentation and logic to prevent discrepancies.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Acknowledged. dev-lead.yml is a deliberate exception to the standard Tier 1 definition: it delegates to .github-private (not .github) and pins via @main. The stub/reusable separation and no-inline-edits contract still hold. Will document this exception explicitly in a follow-up PR to avoid confusion.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in this commit: the Required Workflows overview now says "SonarCloud, and Dev-Lead Agent workflows are documented as patterns below" and the new-repo checklist step 5 now says "Add dev-lead.yml".

| **2. Per-repo template** | `ci.yml`, `sonarcloud.yml` | _(no template — see the patterns documented below)_ | In each repo, because the workflow is tech-stack-specific (language matrix, build tool, test framework) | **Limited.** Each adopting repo carries its own copy. Stay within the patterns in this document; do not change action SHAs, permission scopes, trigger events, or job names without raising a standards PR first. |
| **GitHub-managed** | CodeQL default setup | _(no workflow file — managed via repo Settings → Code security)_ | GitHub | None. Configured via `apply-repo-settings.sh`; per-repo `codeql.yml` files are treated as drift by the compliance audit. See [§2 CodeQL Analysis](#2-codeql-analysis-github-managed-default-setup). |
| **3. Free per-repo** | `release.yml`, project-specific automation | _(out of scope for this standard)_ | Per-repo | Free, but must still comply with the [Action Pinning Policy](#action-pinning-policy) and the [Required Workflows](#required-workflows) constraints. |
Expand All @@ -44,7 +44,8 @@ reusable, not a local edit.
| Template | Tier | Purpose |
|----------|------|---------|
| [`agent-shield.yml`](workflows/agent-shield.yml) | 1 | Deep agent-config security scan via `ecc-agentshield` |
| [`claude.yml`](workflows/claude.yml) | 1 | Thin caller delegating to the org-level reusable Claude Code workflow (PR reviews, issue automation, CI failure fixes) |
| [`dev-lead.yml`](workflows/dev-lead.yml) | 1 | Event-driven AI automation (PR fixes, CI relay, review responses, issue handling) — replaced `claude.yml` 2026-05 |

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update required-check guidance for dev-lead

Promoting dev-lead.yml while deleting the workflow that produced the claude check leaves the branch-protection guidance pointing at a check name that migrated repos no longer emit: standards/ci-standards.md:966 still documents claude, and standards/github-settings.md:229 still lists Claude Code / claude as required for all repos. Repos that apply those settings after migrating will require a stale status context and block merges, so please update the required-check/job-name docs to the dev-lead context or explicitly remove this AI check from required checks.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in this PR: standards/ci-standards.md new-repo checklist step 5 now says "Add dev-lead.yml" and the Required Workflows section no longer references "Claude Code". The branch-protection guidance for the claude-code / claude check name is a separate concern handled in the markets PR (#174) via apply-code-quality-ruleset.sh.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update onboarding to add dev-lead

Promoting dev-lead.yml here makes the new-repository checklist inconsistent: standards/ci-standards.md:1036 still instructs new repos to “Add claude.yml” for AI code review. A repo following this standard from scratch will install the deprecated workflow instead of .github/workflows/dev-lead.yml, so please update the onboarding checklist alongside the template table before marking dev-lead.yml as the replacement.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: step 5 of the "Applying CI to a New Repository" checklist now reads "Add dev-lead.yml from standards/workflows/ for AI-driven PR automation".

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update required-workflow text to dev-lead

After adding dev-lead.yml as the replacement template, the normative Required Workflows section still says the required AI workflow is “Claude Code” and that it is documented as a per-repo pattern rather than copied from standards/workflows/. Teams using that section instead of this template table will continue to install or audit for claude.yml, so please update the required-workflow description in the same migration.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in the same commit — both the normative Required Workflows overview and the new-repo checklist now reference dev-lead.yml rather than claude.yml.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Exempt the dev-lead reusable from pinning audits

Making dev-lead.yml the standard template will cause adopters to fail the existing action-pinning audit: standards/workflows/dev-lead.yml calls petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@main, while scripts/compliance-audit.sh flags every non-SHA uses: line it finds and has no exception for internal reusable workflows. Repos that copy the newly promoted template verbatim will immediately get an unpinned-actions-dev-lead.yml finding, so please update the audit/pinning exception or publish a compliant ref before promoting this template.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct. dev-lead.yml uses @main for the reusable ref, which the pinning audit will flag. This requires an exemption in compliance-audit.sh similar to the existing .github exemption for its own reusables. Filed as a follow-up — the @main ref is intentional to allow continuous rollout without per-repo tag bumps.

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Grant dev-lead the Claude OIDC permission

Promoting dev-lead.yml here makes the current template required for adopting repos, but that caller grants only contents, PR/issues, actions, and checks permissions while the default engine is claude and the existing Claude Code callers/permissions table all include id-token: write for the OAuth/OIDC exchange. Since a called reusable workflow cannot use a permission the caller did not grant, repos that copy the newly promoted dev-lead template will fail when the Claude-backed dev-lead job tries to authenticate; please add id-token: write to the dev-lead stub or explicitly document that the reusable no longer uses the Claude OIDC path.

Useful? React with 👍 / 👎.

| ~~[`claude.yml`](workflows/claude.yml)~~ | ~~1~~ | **Deprecated 2026-05.** Replaced by `dev-lead.yml`. See [§5 Migration](#migration-from-claudeyml). |

@chatgpt-codex-connector chatgpt-codex-connector Bot May 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update enforcement before retiring claude.yml

Repos that follow this new guidance and delete claude.yml will still fail the org compliance automation: scripts/compliance-audit.sh:37 keeps claude.yml in REQUIRED_WORKFLOWS, check_required_workflows emits an error for missing required workflows, and scripts/deploy-standard-workflows.sh:42 still deploys claude.yml instead of dev-lead.yml. Please update the audit/deploy enforcement in the same change before marking claude.yml as replaced, otherwise migrated repos will be flagged or remediated back to the deprecated workflow.

Useful? React with 👍 / 👎.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: scripts/compliance-audit.sh updated in this PR — replaced claude.yml with dev-lead.yml in REQUIRED_WORKFLOWS, swapped "claude.yml:claude-code-reusable" → "dev-lead.yml:dev-lead-reusable" in the centralized stubs list, and commented out the now-dead check_claude_workflow_checkout call.

@gemini-code-assist gemini-code-assist Bot May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The PR description mentions that the claude.yml template is being deleted. If the file standards/workflows/claude.yml is removed, this link will become broken. Even if the file remains for historical reasons, it is better to remove the link to prevent accidental adoption of a deprecated standard.

Suggested change
| ~~[`claude.yml`](workflows/claude.yml)~~ | ~~1~~ | **Deprecated 2026-05.** Replaced by `dev-lead.yml`. See [§5 Migration](#migration-from-claudeyml). |
| claude.yml | 1 | Deprecated 2026-05. Replaced by dev-lead.yml. See [§5 Migration](#migration-from-claudeyml). |

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The template file standards/workflows/claude.yml is being kept for historical reference — it is not deleted in this PR. The link in the deprecated table row remains valid.

Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
| [`dependabot-automerge.yml`](workflows/dependabot-automerge.yml) | 1 | Auto-approve and squash-merge eligible Dependabot PRs |
| [`auto-rebase.yml`](workflows/auto-rebase.yml) | 1 | Keep non-Dependabot PRs up-to-date with the base branch on every push to `main` |
| [`dependabot-rebase.yml`](workflows/dependabot-rebase.yml) | 1 | Update and auto-merge eligible Dependabot PRs on every push to `main` |
Expand Down Expand Up @@ -296,7 +297,12 @@ If omitted, gitleaks runs in open-source mode (free, no license needed).
| `missing gitleaks license` | License not passed to action | Ensure env includes `GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}` |
| Secrets found | Legitimate secrets in the code | Use `.gitleaksignore` to allowlist false positives, or remove the secret |

### 5. Claude Code (`claude.yml`)
### 5. Claude Code (`claude.yml`) — *Deprecated 2026-05*

> **Deprecated.** `claude.yml` has been removed from all `petry-projects` repos and replaced by
> `dev-lead.yml`. See [Adopting the Dev-Lead Agent](#adopting-the-dev-lead-agent) and
> [Migration from `claude.yml`](#migration-from-claudeyml). The content below is preserved for
> historical reference only.
Comment on lines +302 to +305

@gemini-code-assist gemini-code-assist Bot May 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The deprecation banner states that claude.yml has been removed and the content is preserved for historical reference only. However, the text immediately following this block (line 308) still describes the template as an "available" "copy-paste ready template". This is inconsistent. Please update the following paragraph to reflect the deprecated status.

References
  1. Ensure that updates to bot handles or mention triggers are applied consistently across both documentation and the corresponding GitHub Actions workflow logic to prevent discrepancies between documented behavior and actual trigger logic.

@don-petry don-petry May 16, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed: the sentence now reads "The template at standards/workflows/claude.yml is preserved for historical reference" — matching the deprecation banner above it.

Comment thread
coderabbitai[bot] marked this conversation as resolved.

AI-assisted code review on PRs and issue automation via Claude Code Action.
A copy-paste ready template is available at [`standards/workflows/claude.yml`](workflows/claude.yml).
Expand Down
Loading