feat: implement issue #221 — Compliance: non-stub-dependabot-rebase.yml

.github/workflows/dev-lead.yml

@@ -43,14 +43,7 @@
 
 jobs:
   dev-lead:
-    # Pinned to the moving dev-lead/stable channel tag, not @main, so a broken
-    # change to dev-lead can no longer gate its own fix (the self-host circular
-    # dependency). Promotion is done by moving the dev-lead/stable tag centrally; this
-    # caller is never edited on release. agent_ref threads the same channel into
-    # dev-lead's own scripts/prompts checkout. See ci-standards.md#dev-lead-agent.
-    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@3f9e5808b5f3965c96f5698b0d8ff46550b45ba7 # dev-lead/stable
-    with:
-      agent_ref: dev-lead/stable
+    uses: petry-projects/.github-private/.github/workflows/dev-lead-reusable.yml@dev-lead/stable
     secrets: inherit
     permissions:
       contents: write

.github/workflows/feature-ideation.yml

@@ -88,7 +88,7 @@
       discussions: write
       id-token: write
       actions: read
-    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@cc05a74683f8e3564592878e417bb20f8013f16f # v1
+    uses: petry-projects/.github/.github/workflows/feature-ideation-reusable.yml@feature-ideation/v1
     with:
       # === CUSTOMISE THIS PER REPO — the only required edit ===
       # Replace this paragraph with a 3-5 sentence description of your project,

.github/workflows/pr-review-mention.yml

@@ -35,7 +35,9 @@ permissions: {}
 
 jobs:
   pr-review-mention:
+    if: github.event.sender.type != 'Bot'
     permissions:
       pull-requests: write
+      statuses: read
     uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@v2
     secrets: inherit

.gitleaksignore

@@ -213,3 +213,55 @@ a7c7e060359d709d21bc62fe80ba7504cf240c3e:_bmad/_config/files-manifest.csv:generi
 85cb1f5ffd6e0ed36ea87f8b2370a6746a5727c0:_bmad/_config/files-manifest.csv:generic-api-key:300
 85cb1f5ffd6e0ed36ea87f8b2370a6746a5727c0:_bmad/_config/files-manifest.csv:generic-api-key:409
 85cb1f5ffd6e0ed36ea87f8b2370a6746a5727c0:_bmad/_config/files-manifest.csv:generic-api-key:433
+
+# Commits 32c0df72, 6107c66e, 9d10fb39, b9ad0c5f: same _bmad/_config/files-manifest.csv CSV rows as
+# above (SHA256 content checksums of BMAD skill files). Same false-positive rationale;
+# file content checksums in CSV, not API keys. These commits appear in the full-history gitleaks
+# scan triggered by PR #305 but were not previously suppressed. Pattern is identical to prior entries.
+32c0df72eb096e66a669ba2e238b42306ccafd8f:_bmad/_config/files-manifest.csv:generic-api-key:281
+32c0df72eb096e66a669ba2e238b42306ccafd8f:_bmad/_config/files-manifest.csv:generic-api-key:282
+32c0df72eb096e66a669ba2e238b42306ccafd8f:_bmad/_config/files-manifest.csv:generic-api-key:284
+32c0df72eb096e66a669ba2e238b42306ccafd8f:_bmad/_config/files-manifest.csv:generic-api-key:300
+32c0df72eb096e66a669ba2e238b42306ccafd8f:_bmad/_config/files-manifest.csv:generic-api-key:409
+32c0df72eb096e66a669ba2e238b42306ccafd8f:_bmad/_config/files-manifest.csv:generic-api-key:433
+6107c66e87b3b29fc4625b71b2813b4025a851a3:_bmad/_config/files-manifest.csv:generic-api-key:281
+6107c66e87b3b29fc4625b71b2813b4025a851a3:_bmad/_config/files-manifest.csv:generic-api-key:282
+6107c66e87b3b29fc4625b71b2813b4025a851a3:_bmad/_config/files-manifest.csv:generic-api-key:284
+6107c66e87b3b29fc4625b71b2813b4025a851a3:_bmad/_config/files-manifest.csv:generic-api-key:300
+6107c66e87b3b29fc4625b71b2813b4025a851a3:_bmad/_config/files-manifest.csv:generic-api-key:409
+6107c66e87b3b29fc4625b71b2813b4025a851a3:_bmad/_config/files-manifest.csv:generic-api-key:433
+9d10fb3917e4f220cc9ce88b5063129adbe905e3:_bmad/_config/files-manifest.csv:generic-api-key:281
+9d10fb3917e4f220cc9ce88b5063129adbe905e3:_bmad/_config/files-manifest.csv:generic-api-key:282
+9d10fb3917e4f220cc9ce88b5063129adbe905e3:_bmad/_config/files-manifest.csv:generic-api-key:284
+9d10fb3917e4f220cc9ce88b5063129adbe905e3:_bmad/_config/files-manifest.csv:generic-api-key:300
+9d10fb3917e4f220cc9ce88b5063129adbe905e3:_bmad/_config/files-manifest.csv:generic-api-key:409
+9d10fb3917e4f220cc9ce88b5063129adbe905e3:_bmad/_config/files-manifest.csv:generic-api-key:433
+b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:281
+b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:282
+b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:284
+b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:300
+b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:409
+b9ad0c5f78bf39d721924e8925c269d85b338735:_bmad/_config/files-manifest.csv:generic-api-key:433
+
+# Commits a84a557b, 9a04fdd8, 9372be36: same _bmad/_config/files-manifest.csv CSV rows as above
+# (SHA256 content checksums of BMAD skill files). Same false-positive rationale;
+# file content checksums in CSV, not API keys. These commits appear in the full-history gitleaks
+# scan triggered by PR #305 but were not previously suppressed. Pattern is identical to prior entries.
+a84a557b6d1a291df3756b15a62bd3f40653cc00:_bmad/_config/files-manifest.csv:generic-api-key:281
+a84a557b6d1a291df3756b15a62bd3f40653cc00:_bmad/_config/files-manifest.csv:generic-api-key:282
+a84a557b6d1a291df3756b15a62bd3f40653cc00:_bmad/_config/files-manifest.csv:generic-api-key:284
+a84a557b6d1a291df3756b15a62bd3f40653cc00:_bmad/_config/files-manifest.csv:generic-api-key:300
+a84a557b6d1a291df3756b15a62bd3f40653cc00:_bmad/_config/files-manifest.csv:generic-api-key:409
+a84a557b6d1a291df3756b15a62bd3f40653cc00:_bmad/_config/files-manifest.csv:generic-api-key:433
+9a04fdd88314632ec914b9f045528a1291d275d9:_bmad/_config/files-manifest.csv:generic-api-key:281
+9a04fdd88314632ec914b9f045528a1291d275d9:_bmad/_config/files-manifest.csv:generic-api-key:282
+9a04fdd88314632ec914b9f045528a1291d275d9:_bmad/_config/files-manifest.csv:generic-api-key:284
+9a04fdd88314632ec914b9f045528a1291d275d9:_bmad/_config/files-manifest.csv:generic-api-key:300
+9a04fdd88314632ec914b9f045528a1291d275d9:_bmad/_config/files-manifest.csv:generic-api-key:409
+9a04fdd88314632ec914b9f045528a1291d275d9:_bmad/_config/files-manifest.csv:generic-api-key:433
+9372be36e63c54da1cf13f930391600bb68e8d02:_bmad/_config/files-manifest.csv:generic-api-key:281
+9372be36e63c54da1cf13f930391600bb68e8d02:_bmad/_config/files-manifest.csv:generic-api-key:282
+9372be36e63c54da1cf13f930391600bb68e8d02:_bmad/_config/files-manifest.csv:generic-api-key:284
+9372be36e63c54da1cf13f930391600bb68e8d02:_bmad/_config/files-manifest.csv:generic-api-key:300
+9372be36e63c54da1cf13f930391600bb68e8d02:_bmad/_config/files-manifest.csv:generic-api-key:409
+9372be36e63c54da1cf13f930391600bb68e8d02:_bmad/_config/files-manifest.csv:generic-api-key:433