feat: implement issue #90 — Compliance: codeql-default-setup-not-configured

[don-petry]

Closes #90

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

• Chores
  • Updated repository ignore patterns to extend existing configuration
  • Configured automatic GitHub CodeQL setup integration for repositories
  • Added verification checks for repository settings configuration

[coderabbitai]

Warning

Review limit reached

@don-petry, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 39 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: ffb439dc-33cf-4d54-986f-c92ba3a98ca7

📥 Commits

Reviewing files that changed from the base of the PR and between 556da23 and d87ca3e.

📒 Files selected for processing (1)

• tools/test-repo-settings.sh

📝 Walkthrough

Walkthrough

The PR addresses CodeQL compliance requirements by implementing automated default setup for code scanning in the repository settings script, alongside validation to ensure the configuration was applied correctly. A single GitIgnore entry for dev-lead directories is appended separately.

Changes

CodeQL default setup configuration

Layer / File(s)	Summary
CodeQL default setup implementation and validation scripts/apply-repo-settings.sh, tools/test-repo-settings.sh	apply-repo-settings.sh adds a gh api PATCH call to enable CodeQL default setup with state configured and query suite default. test-repo-settings.sh adds a coverage check (Check 2) that validates the API call is present and both configuration parameters are set correctly.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• petry-projects/bmad-bgreat-suite#202: Both PRs update .gitignore to add another ignore rule/entry for the /.dev-lead/ directory.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: implementing CodeQL default setup configuration as specified in issue #90.
Linked Issues check	✅ Passed	The PR implements the required CodeQL default setup by adding API call to enable GitHub-managed CodeQL in apply-repo-settings.sh and verifying it in test-repo-settings.sh, directly addressing issue #90's remediation requirements.
Out of Scope Changes check	✅ Passed	All changes are scoped to implementing CodeQL default setup compliance: updating .gitignore for dev-lead directory, enabling CodeQL setup in apply-repo-settings.sh, and adding verification tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev-lead/issue-90-20260602-1213

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request configures GitHub-managed CodeQL scanning (default setup) in the repository settings script and adds corresponding validation checks in the test script. Feedback highlights a portability issue in the test script where GNU-specific grep syntax is used instead of grep -E, and notes that the .gitignore file contains numerous duplicate .dev-lead/ entries that should be cleaned up.

[Copilot]

Pull request overview

Adds CodeQL default setup configuration to the repo-settings application script (closing compliance issue #90) and a coverage check in the settings test to ensure that step stays present.

Changes:

• Append a gh api PATCH /repos/{REPO}/code-scanning/default-setup call setting state=configured and query_suite=default in scripts/apply-repo-settings.sh.
• Add a new "Check 2" in tools/test-repo-settings.sh validating the script references the default-setup endpoint with the expected state and query suite.
• Add another duplicate .dev-lead/ line to .gitignore.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
scripts/apply-repo-settings.sh	Adds CodeQL default-setup PATCH call to satisfy the compliance check.
tools/test-repo-settings.sh	Adds coverage check ensuring the apply script keeps the CodeQL default-setup call with correct fields.
.gitignore	Appends an additional duplicate .dev-lead/ entry (unrelated, increases existing noise).

[don-petry]

Dev-Lead — review-changes (applied)

Changes committed and pushed.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/test-repo-settings.sh`:
- Around line 37-40: The grep validation uses overly broad alternatives
('state.*configured' and 'query_suite.*default') that can match incorrect
values; update the two conditional checks to only test for the CLI flag form
(state=configured and query_suite=default) and the exact JSON form
("state":"configured" and "query_suite":"default")—i.e., remove the third '.*'
alternatives from the two grep patterns so the checks only use
'state=configured\|"state":"configured"' and
'query_suite=default\|"query_suite":"default"'.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: e00ee860-e245-48c5-980e-988451c94a75

📥 Commits

Reviewing files that changed from the base of the PR and between 5b82cc7 and 556da23.

📒 Files selected for processing (3)

• .gitignore
• scripts/apply-repo-settings.sh
• tools/test-repo-settings.sh

[don-petry]

@dev-lead please process and advance this PR — fix any failing CI, resolve outstanding review threads, and enable auto-merge once it's green and approvable.

[don-petry]

Dev-Lead — on-mention (applied)

Changes committed and pushed.

[don-petry]

@coderabbitai resolve

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 1
- Overly broad grep patterns in tools/test-repo-settings.sh lines 37-40:
  Already fixed in prior commit 39fa7e5 — patterns use exact matches
  ('state=configured|"state":"configured"' and
  'query_suite=default|"query_suite":"default"') with no '.*' wildcards.
  Thread is already resolved (isResolved: true). No further action required.
Files changed: none (fix already in HEAD)
Skipped (informational): 0
```

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[don-petry]

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0 (all already fixed in prior commits)
Files changed: none
Skipped (informational): 0
Review thread summary:
- coderabbitai: overly-broad grep patterns → already fixed (grep -E, no .* alternatives) → thread resolved/outdated
- copilot: same grep pattern issue → already fixed → thread resolved/outdated
- gemini-code-assist: GNU grep portability + .gitignore duplicates → both already fixed → threads resolved/outdated
```
No changes required — the PR is clean and approved.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.

[donpetry-bot]

@donpetry-bot I'm on it — starting a fresh review now. Results will appear in a few minutes.