feat: implement issue #772 — Compliance: ruleset-drift-code-quality-required_status_checks

.github/workflows/dependency-audit.yml

@@ -1,14 +1,21 @@
-# Dependency vulnerability audit.
-# Detects ecosystems and runs appropriate audit tools (npm, pnpm, Go, Rust, Python).
-# Standard: https://github.com/petry-projects/.github/blob/main/standards/dependabot-policy.md#vulnerability-audit-ci-check
+# ─────────────────────────────────────────────────────────────────────────────
+# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml
+# Standard:        petry-projects/.github/standards/ci-standards.md#7-dependency-audit-dependency-audityml
+# Reusable:        petry-projects/.github/.github/workflows/dependency-audit-reusable.yml
 #
-# Auto-detects ecosystems present in the repository and runs the appropriate
-# audit tool. Fails the build if any dependency has a known security advisory.
+# AGENTS — READ BEFORE EDITING:
+#   • This file is a THIN CALLER STUB. All ecosystem-detection and audit logic
+#     lives in the reusable workflow above.
+#   • You MUST NOT change: trigger events, the `uses:` line, or the job name
+#     `dependency-audit` — it composes the required status check
+#     `dependency-audit / Detect ecosystems` (codified in
+#     standards/rulesets/code-quality.json).
+#   • If you need different behaviour (new ecosystem, tool version bump),
+#     open a PR against the reusable in the central repo.
+# ─────────────────────────────────────────────────────────────────────────────
 #
-# Add "dependency-audit" as a required status check in branch protection.
-#
-# Pinned tool versions (update deliberately):
-#   govulncheck v1.1.4 | cargo-audit 0.22.1 | pip-audit 2.9.0
+# Dependency vulnerability audit — thin caller for the org-level reusable.
+# Required status check: "dependency-audit / Detect ecosystems".
 name: Dependency audit
 
 on:
@@ -21,198 +28,5 @@ permissions:
   contents: read
 
 jobs:
-  detect:
-    name: Detect ecosystems
-    runs-on: ubuntu-latest
-    outputs:
-      npm: ${{ steps.check.outputs.npm }}
-      pnpm: ${{ steps.check.outputs.pnpm }}
-      gomod: ${{ steps.check.outputs.gomod }}
-      cargo: ${{ steps.check.outputs.cargo }}
-      pip: ${{ steps.check.outputs.pip }}
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - name: Detect package ecosystems
-        id: check
-        run: |
-          # npm — look for package-lock.json anywhere (excluding node_modules)
-          if find . -name 'package-lock.json' -not -path '*/node_modules/*' | grep -q .; then
-            echo "npm=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "npm=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # pnpm — look for pnpm-lock.yaml anywhere
-          if find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' | grep -q .; then
-            echo "pnpm=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "pnpm=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Go modules — detect via go.mod (not go.sum, which may not exist)
-          if find . -name 'go.mod' -not -path '*/vendor/*' | grep -q .; then
-            echo "gomod=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "gomod=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Cargo — detect via Cargo.toml anywhere (lockfile may not exist for libraries)
-          if find . -name 'Cargo.toml' -not -path '*/target/*' | grep -q .; then
-            echo "cargo=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "cargo=false" >> "$GITHUB_OUTPUT"
-          fi
-
-          # Python — detect pyproject.toml or requirements.txt anywhere
-          if find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q . || \
-             find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q .; then
-            echo "pip=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "pip=false" >> "$GITHUB_OUTPUT"
-          fi
-
-  audit-npm:
-    name: npm audit
-    needs: detect
-    if: needs.detect.outputs.npm == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "lts/*"
-
-      - name: Audit npm dependencies
-        run: |
-          # Audit each package-lock.json found in the repo
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::npm audit $dir"
-            if ! (cd "$dir" && npm audit --audit-level=low); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'package-lock.json' -not -path '*/node_modules/*' -exec dirname {} \;)
-          exit $status
-
-  audit-pnpm:
-    name: pnpm audit
-    needs: detect
-    if: needs.detect.outputs.pnpm == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v4
-
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
-        with:
-          node-version: "lts/*"
-
-      - name: Audit pnpm dependencies
-        run: |
-          # Audit each pnpm-lock.yaml found in the repo
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::pnpm audit $dir"
-            if ! (cd "$dir" && pnpm audit --audit-level low); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' -exec dirname {} \;)
-          exit $status
-
-  audit-go:
-    name: govulncheck
-    needs: detect
-    if: needs.detect.outputs.gomod == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v5
-        with:
-          go-version: "stable"
-
-      - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4  # NOSONAR(githubactions:S8545) pinned @vX.Y.Z is reproducible (verified via Go checksum DB); no --locked equivalent
-
-      - name: Audit Go dependencies
-        run: |
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::govulncheck $dir"
-            if ! (cd "$dir" && govulncheck ./...); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'go.mod' -not -path '*/vendor/*' -exec dirname {} \;)
-          exit $status
-
-  audit-cargo:
-    name: cargo audit
-    needs: detect
-    if: needs.detect.outputs.cargo == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
-
-      - name: Install cargo-audit
-        run: cargo install cargo-audit@0.22.1 --locked
-
-      - name: Audit Cargo dependencies
-        run: |
-          # cargo audit operates on Cargo.lock at workspace root
-          # For workspaces, a single audit at root covers all crates
-          status=0
-          while IFS= read -r dir; do
-            echo "::group::cargo audit $dir"
-            if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null; cargo audit); then
-              status=1
-            fi
-            echo "::endgroup::"
-          done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u)
-          exit $status
-
-  audit-pip:
-    name: pip-audit
-    needs: detect
-    if: needs.detect.outputs.pip == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.x"
-
-      - name: Install pip-audit
-        run: 'pip install --require-hashes --only-binary :all: -r scripts/pip-audit-requirements.txt'
-
-      - name: Audit Python dependencies
-        run: |
-          status=0
-          # Audit each Python project found in the repo
-          while IFS= read -r dir; do
-            echo "::group::pip-audit $dir"
-            if [ -f "$dir/pyproject.toml" ]; then
-              if ! pip-audit "$dir"; then
-                status=1
-              fi
-            elif [ -f "$dir/requirements.txt" ]; then
-              if ! pip-audit -r "$dir/requirements.txt"; then
-                status=1
-              fi
-            fi
-            echo "::endgroup::"
-          done < <(
-            {
-              find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \;
-              find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \;
-            } | sort -u
-          )
-          exit $status
+  dependency-audit:
+    uses: ./.github/workflows/dependency-audit-reusable.yml  # local ref — always current (ring0 dogfood, #541)

AGENTS.md

@@ -622,6 +622,33 @@
 > treat these as intentional exemptions. To change the cap or the exempt list,
 > follow the runbook in [`standards/pr-limits.md`](https://github.com/petry-projects/.github/blob/main/standards/pr-limits.md).
 
+#### Pull Request Limits (automation open-PR cap)
+
+The org enforces a **soft ceiling on concurrent open, non-draft automation PRs
+org-wide** so automation cannot outrun merge throughput and inflate the
+auto-rebase fan-out. Full standard, rationale, and operator runbook:
+[`standards/pr-limits.md`](https://github.com/petry-projects/.github/blob/main/standards/pr-limits.md).
+
+- **GitHub has no native "max open PRs" surface** (no repo setting, org setting,
+  or ruleset rule — verified in the [ADR](https://github.com/petry-projects/.github/blob/main/docs/initiatives/pull-request-limits-adr.md)),
+  so this is enforced **source-side** by [`scripts/lib/pr-limit-gate.sh`](https://github.com/petry-projects/.github/blob/main/scripts/lib/pr-limit-gate.sh):
+  a PR-creating workflow asks the gate before opening a PR and **defers** (never
+  fails or closes) when the queue is at the cap. Live-path wiring is Story 3 (#508).
+- **The configured value lives only in [`standards/pr-limits.json`](https://github.com/petry-projects/.github/blob/main/standards/pr-limits.json)** —
+  the single source of truth. Read it with `jq`; never hardcode or restate it.
+
+> **Exempt actors are sanctioned policy, not drift.** `dependabot[bot]`,
+> `OrganizationAdmin`, `@petry-projects/org-leads`, the `dependabot-automerge-petry`
+> app, and `security`-labeled PRs are on the cap's exempt list — never blocked
+> and never counted. This mirrors the ruleset bypass-actor allowance (see
+> [Ruleset remediation](https://github.com/petry-projects/.github/blob/main/standards/ruleset-remediation-runbook.md)):
+> `dependabot[bot]` is already bounded by its own per-ecosystem
+> `open-pull-requests-limit` (so counting it here would double-cap and could
+> starve a security PR), the human/admin actors are break-glass and maintainer
+> traffic, and the app only operates on existing PRs. A compliance audit should
+> treat these as intentional exemptions. To change the cap or the exempt list,
+> follow the runbook in [`standards/pr-limits.md`](https://github.com/petry-projects/.github/blob/main/standards/pr-limits.md).
+
 ---
 
 ## Multi-Agent Isolation — Git Worktrees
@@ -1087,6 +1114,120 @@
 
 ---
 
+## Multi-Agent Isolation — Git Worktrees
+
+When multiple agents work on the same repository concurrently, they MUST use **isolated workspaces** to prevent conflicts. Git worktrees are the industry-standard isolation primitive — used by Claude Code, Cursor, Windsurf, Augment Intent, and dmux. Cloud agents (OpenAI Codex, GitHub Copilot, Devin) use containers or ephemeral environments that provide equivalent isolation.
+
+Never have two agents working in the same working directory simultaneously.
+
+### Rules
+
+1. **One workspace per agent.** Every agent performing code changes MUST operate in its own isolated workspace (git worktree, container, or ephemeral environment). This applies to Claude Code (`isolation: "worktree"` or `--worktree`), Cursor parallel agents, GitHub Copilot coding agent, OpenAI Codex, and any other AI agent tool.
+2. **One agent per story/task.** Each workspace maps to exactly one BMAD story, feature, or bug fix. Do not assign the same story to multiple agents.
+3. **No overlapping file ownership.** Two agents MUST NOT modify the same file concurrently. If stories touch shared files (e.g., a shared type definition, config, or lockfile), serialize those stories — do not run them in parallel. This is the single most important rule for multi-agent work.
+4. **Branch from the default branch.** Workspaces MUST branch from the repository's configured default branch (for example, `origin/main`). You MAY use `origin/HEAD` as a shortcut when it is correctly configured, but MUST NOT rely on it being present. Never branch from another agent's branch.
+5. **One PR per workspace.** Each workspace produces exactly one pull request. Do not combine unrelated changes.
+6. **3–5 parallel agents max.** Coordination overhead increases non-linearly. Limit concurrent agents to 3–5 per repository.
+
+### Detecting File Overlap
+
+Before launching parallel agents, verify that stories won't modify the same files:
+
+1. Review each story's acceptance criteria and implementation scope for shared files
+2. Use `git log --stat` on recent similar changes to identify likely touched files
+3. If any overlap is detected or uncertain, serialize the stories — do not run them in parallel
+
+### Worktree Naming Convention
+
+Use descriptive worktree names that identify the scope. For tools that auto-generate branch names from your input (see table below), the name you choose flows into the branch name automatically.
+
+| Tool | You provide | Branch created |
+|------|------------|----------------|
+| Claude Code (`--worktree <name>`) | `S-3.1-hive-health-card` | `worktree-S-3.1-hive-health-card` |
+| Claude Code subagent (`isolation: "worktree"`) | Agent `name` field | `worktree-<name>` |
+| GitHub Copilot coding agent | Task description | `copilot/<descriptive-name>` (auto) |
+| Cursor parallel agents | Prompt | `feat-N-<random>` (auto) |
+| Manual worktree | Full branch name | Whatever you specify |
+
+**Name format:** `<story-or-task-id>-<short-description>`
+
+Examples: `S-3.1-hive-health-card`, `fix-auth-token-expiry`, `S-2.4-offline-sync-banner`
+
+### Tool-Specific Setup
+
+**Claude Code subagents** — set `isolation: "worktree"` in the agent definition:
+
+```yaml
+---
+name: S-3.1-hive-health-card
+isolation: "worktree"
+---
+```
+
+**Claude Code CLI sessions** — start in a named worktree:
+
+```bash
+claude --worktree S-3.1-hive-health-card
+```
+
+**GitHub Copilot coding agent** — assign a task via GitHub Issues or the Copilot panel. Copilot creates its own branch (`copilot/...`) and ephemeral environment automatically.
+
+**OpenAI Codex** — use worktree mode in the Codex app, or assign tasks to the cloud agent which runs in isolated containers.
+
+**Manual worktree** (for tools without built-in support):
+
+```bash
+git worktree add .worktrees/<name> -b agent/<story-id>-<description>
+cd .worktrees/<name>
+# run agent session here
+```
+
+### Environment & Dependencies
+
+- Git worktrees are fresh checkouts — gitignored files (`.env`, `.env.local`) are NOT copied automatically.
+- For Claude Code: add a **`.worktreeinclude`** file at the repo root listing gitignored files that should be copied into new worktrees:
+
+  ```text
+  .env
+  .env.local
+  ```
+
+- After entering a worktree, **install dependencies** (`npm install`, `go mod download`, etc.) before starting work.
+
+### Cleanup
+
+- If the worktree has **no changes**, it is automatically removed when the agent session ends (Claude Code, Cursor).
+- If the worktree has **uncommitted changes**, the agent MUST commit or discard before exiting. Do not leave dirty worktrees.
+- After a PR is merged, remove the worktree and its branch:
+
+  ```bash
+  git worktree remove <worktree-path>
+  git branch -d <branch-name>  # safe delete; may fail after squash/rebase merges
+  # If the above fails and you've confirmed the PR is merged:
+  git branch -D <branch-name>
+  ```
+
+### Repository Configuration
+
+Add worktree directories to the project's `.gitignore`:
+
+```gitignore
+# Agent worktrees
+.claude/worktrees/
+.worktrees/
+```
+
+### Coordination Checklist (for humans orchestrating multiple agents)
+
+Before launching parallel agents, verify:
+- [ ] Each agent has a distinct story/task assignment
+- [ ] No two agents will modify the same files
+- [ ] Shared dependencies (lockfiles, generated types) are up to date on the default branch before agents start
+- [ ] If stories share a dependency file, run them sequentially, not in parallel
+- [ ] No more than 3–5 agents are running concurrently on the same repository
+
+---
+
 ## Agent Operation Guidance
 
 - Prefer interactive or dev commands when iterating; avoid running production-only commands from an agent session.