Repository navigation
feat: implement issue #645 — [Phase 3] Integrate the linter into the compliance audit (informational) + org-repo import consistency - #1061
Conversation
…compliance audit (informational) + org-repo import consistency
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Important Approval pendingCodeRabbit has no unresolved comments, but it has not reviewed the latest commit. Use the checkbox below to review the latest commit. CodeRabbit will approve the changes if it finds no blocking issues.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request integrates the standalone agents-md-lint.sh structural linter into the compliance audit workflow as an informational, non-blocking check. It records structural findings for AGENTS.md files in a separate accumulator, appends them to the run summary, and introduces a comprehensive suite of BATS tests to verify this integration. The review feedback suggests optimizing the structural findings parser in Bash by replacing a loop containing a here-string with an awk pipeline to reduce subprocess overhead. Additionally, the feedback recommends improving the BATS assertions by explicitly checking for an exit status of 1 when verifying the absence of patterns with grep to avoid false positives.
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Wires the Phase 1/2 AGENTS.md structural linter (scripts/agents-md-lint.sh) into the compliance audit as an informational, non-blocking check, plus a cross-repo import-consistency rule under downstream scope. Findings accumulate in a separate TSV (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never fail the run. 266-line bats suite covers scope selection, recording, 404/presence non-regression, and summary rendering. Triage assessment confirmed correct.
Linked issue analysis
Closes #645. The issue's Dev Notes reference scripts/aw-standards-sync.sh, which does not exist in this repo — the issue title ("Integrate the linter into the compliance audit") matches the actual target, scripts/compliance-audit.sh. All 5 acceptance criteria substantively addressed: (1) linter runs per scanned repo, informational summary section only; (2) org-repo-import-consistency check under downstream scope with canonical (.github) exemption; (3) 404 presence path unchanged, linter runs only when content exists (tested); (4) bats tests with stubbed gh_api, no network; ShellCheck CI green; (5) summary labelled informational and links to docs/initiatives/agents-md-validation.md (verified present at head SHA).
Findings
Verified against the head SHA: amdl_lint's signature, AMDL_DEFAULT_RULES, the BASH_SOURCE CLI guard (sourcing only defines functions), and the level/rule/line/msg TSV output all match the PR's usage. Markdown pipe-escaping in summary cells is handled. Non-blocking notes carried from bot threads (dev-lead triaged as no-changes): (a) amdl_lint ... 2>/dev/null || true swallows rc=2 from an invalid rule-set file, so a broken rules JSON would render a falsely-empty "no structural findings" section — acceptable for an informational-only phase, worth hardening when promoted to blocking; (b) bats absence assertions use ! grep -q, which also passes on grep errors (rc=2) — minor test-robustness nit; (c) here-string loop parsing is a micro-optimization suggestion only. Secret-scanning MCP tool not available in this environment; gitleaks CI check is green.
CI status
All substantive checks green: CI Lint, ShellCheck, Agent Security Scan, Secret scan (gitleaks), Compliance Audit Tests (lint+bats), CodeQL, SonarCloud quality gate (0 new issues, 0 hotspots), duplicate-decl-gate, AgentShield, dependency-audit. The cancelled/queued dev-lead runs are agent-orchestration jobs superseded by later triggers, not code checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Integrates the AGENTS.md structural linter (scripts/agents-md-lint.sh) into the compliance audit as an informational, non-blocking check, plus a cross-repo import-consistency rule under downstream scope with a canonical (.github) exemption. Findings accumulate in a separate TSV (never FINDINGS_FILE), so they open no issues, never join the umbrella result, and never fail the run. A 266-line bats suite covers scope selection, recording, 404/presence non-regression, and summary rendering. Triage assessment confirmed correct; a prior single-reviewer approval exists at this same SHA and independent re-verification agrees.
Linked issue analysis
Closes #645. The issue's Dev Notes reference scripts/aw-standards-sync.sh, which does not exist in this repo — verified against the head SHA's scripts/ listing; the issue title ("Integrate the linter into the compliance audit") matches the actual target, scripts/compliance-audit.sh. All 5 acceptance criteria substantively addressed: (1) linter runs per scanned repo, findings surface only in a clearly-labelled informational summary section; (2) org-repo-import-consistency check under downstream scope, canonical repo exempt (both tested); (3) 404/missing-file presence path unchanged — linter runs only when content exists (tested); (4) bats coverage with stubbed gh_api, no network; ShellCheck CI green; (5) summary section labelled informational and links to docs/initiatives/agents-md-validation.md (verified present at head SHA).
Findings
Independently verified against the head SHA: amdl_lint's signature (file, rules, scope), AMDL_DEFAULT_RULES, the BASH_SOURCE CLI guard (sourcing only defines functions), and the level/rule/line/message 4-field TSV finding format all match the PR's sourcing and parsing exactly. Markdown pipe-escaping in summary table cells is handled. Four unresolved bot threads (gemini x3, codeant x1) were triaged by dev-lead as no-changes; all are advisory: (a) 'amdl_lint ... 2>/dev/null || true' swallows rc=2 from an invalid rule-set file, rendering a falsely-empty findings section — acceptable for an informational-only phase, worth hardening at blocking promotion; (b) bats absence assertions via '! grep -q' also pass on grep errors — minor test-robustness nit; (c) here-string-in-loop micro-optimization. No security-sensitive surface touched. Secret-scanning MCP tool unavailable in this environment; the gitleaks CI check is green.
CI status
All substantive checks green: Lint, ShellCheck, Lint and bats, CodeQL, Analyze (actions), SonarCloud quality gate, Secret scan (gitleaks), Agent Security Scan, AgentShield, duplicate-decl-gate, dependency-audit. Cancelled/skipped entries are dev-lead orchestration relays and ecosystem-skipped audits, not code checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Phase 3 of the AGENTS.md validation epic: wires the existing structural linter (scripts/agents-md-lint.sh) into compliance-audit.sh as an informational-only check. Structural findings accumulate in a separate TSV (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never fail the run. A labelled informational summary section renders them as a table with a link to the rule-set doc. 266 lines of bats coverage with stubbed gh_api, no network.
Linked issue analysis
Closes #645 — all 5 acceptance criteria met: (1) linter runs per scanned repo, findings surface informationally in the summary only; (2) cross-repo import consistency covered via the org-repo-import-consistency rule under downstream scope (canonical .github repo correctly exempt); (3) the 404/missing-AGENTS.md presence path returns before the linter runs — no regression, test-covered; (4) bats tests mock gh_api with no network, shellcheck CI green; (5) summary section is labelled informational and links to docs/initiatives/agents-md-validation.md. Note: the issue's dev notes reference aw-standards-sync.sh, which does not exist in the repo — compliance-audit.sh is the actual org-wide audit scanner (matching the issue title), so the integration target is correct.
Findings
Verified: agents-md-lint.sh guards its CLI behind a BASH_SOURCE check (line 458), so sourcing it only defines amdl_lint/AMDL_DEFAULT_RULES as claimed. Markdown pipe-escaping in table cells is handled. No injection surface: finding messages come from the rules JSON, not repo content; no eval/exec of fetched data.
4 unresolved bot review threads, all evaluated as non-blocking:
- gemini (3): here-string-in-loop micro-optimization and bats grep-negation assertion style — cosmetic; the dev-lead review-changes pass already concluded no changes needed.
- codeant (1, 'Major'):
amdl_lint ... 2>/dev/null || truesuppresses linter errors, which could silently report 'no structural findings' if the linter or rules JSON broke. Intentional per the phase-3 never-fail mandate, and the linter has dedicated CI (agents-md-rules-tests.yml) that would catch breakage. Reasonable Phase 4 hardening: log a warning line on non-zero amdl_lint exit instead of fully swallowing stderr.
CI status
All checks green: Lint, ShellCheck, bats (Lint and bats), CodeQL, Analyze (actions), Agent Security Scan, agent-shield, Secret scan (gitleaks), SonarCloud quality gate (0 new issues), duplicate-decl-gate, dependency-audit. CANCELLED/SKIPPED entries are superseded dev-lead dispatch/relay duplicates with later SUCCESS runs. Secret-scanning MCP tool not available in this run; gitleaks CI check passed.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Confirmation review of the triage-approved verdict. The PR wires the standalone AGENTS.md structural linter (scripts/agents-md-lint.sh) into the compliance audit as a strictly informational, non-blocking check, plus a downstream-scope org-repo import-consistency rule, with a dedicated bats suite (266 lines). Verified against the head repo at the reviewed SHA: the sourced linter interface matches exactly (amdl_lint [rules] [scope] emitting 4-field TSV severity/rule/line/message; AMDL_DEFAULT_RULES defined; CLI guarded behind a BASH_SOURCE check so sourcing only defines functions), scripts/lib/agents-md-rules.json and docs/initiatives/agents-md-validation.md both exist, and structural findings are kept out of FINDINGS_FILE so they open no issues and never affect the exit code. The triage assessment holds.
Linked issue analysis
Closes #645 ([Phase 3] Integrate the linter into the compliance audit). All five acceptance criteria are substantively addressed: (1) the linter runs per scanned repo and findings land in a clearly-labelled informational summary section, opening no issues and failing no CI; (2) the cross-repo import check is covered by the org-repo-import-consistency rule applied under downstream scope for non-.github repos, with the canonical repo exempt; (3) the 404/missing-file path returns before the linter runs, so the presence check does not regress — covered by a dedicated test; (4) bats coverage is mocked (gh_api stubbed, no network) and ShellCheck CI is green; (5) the summary section is labelled informational and links to docs/initiatives/agents-md-validation.md (verified present). Note: the issue's Dev Notes reference scripts/aw-standards-sync.sh and tests/, neither of which exists in the repo — the PR correctly targets scripts/compliance-audit.sh (the actual script that enumerates repos and fetches AGENTS.md) and the established test/scripts/compliance-audit/ convention. This is the right interpretation of a stale story reference, not a scope miss.
Findings
No blocking findings. Reviewed for the cascade's three lenses:
- Security: no secrets, no injection vectors (repo names and linter output flow through printf %s formats; mktemp used for the temp copy and removed; no eval/curl-pipe patterns). Markdown table cells escape literal pipes in finding messages. The MCP secret-scanning tool is not available in this environment; the gitleaks CI check passed and the diff contains no credential-like content.
- Correctness: amdl_lint failures are swallowed (2>/dev/null || true) which is appropriate for an informational-only path; empty/undecodable content is a no-op; append_structural_findings_summary runs after generate_summary and before issue management, so the section is part of the summary body without entering the issue-creation path.
- Maintainability: helpers are small, pure where claimed, and well-commented with the phase/issue rationale; the duplicate-decl-gate CI check confirms no symbol collisions from sourcing agents-md-lint.sh.
CI status
All required checks green at the reviewed SHA: ShellCheck, Lint and bats, CodeQL, SonarCloud (quality gate passed), Secret scan (gitleaks), Agent Security Scan, agent-shield, duplicate-decl-gate, dependency-audit. The few CANCELLED/SKIPPED entries are dev-lead agent dispatch/relay runs and ecosystem-skipped audit jobs, not test failures.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Confirmation review (triage-approved mode) of PR #1061, which wires the Phase-2 AGENTS.md structural linter (scripts/agents-md-lint.sh) into scripts/compliance-audit.sh as an informational, non-blocking check, plus 13 new bats tests. The triage assessment holds: findings go to a separate accumulator (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never fail the run — exactly the non-blocking posture issue #645 mandates. Verified the sourced linter interface matches (amdl_lint , CLI guarded behind a BASH_SOURCE check), and that both referenced artifacts (scripts/agents-md-lint.sh, docs/initiatives/agents-md-validation.md) exist on main.
Linked issue analysis
Closes #645 ([Phase 3] Integrate the linter into the compliance audit). All 5 acceptance criteria are substantively addressed: (1) linter runs per scanned repo, findings surfaced in a labelled informational summary section, no issues/CI failures; (2) org-repo-import-consistency covered via downstream scope (canonical .github repo correctly exempt); (3) 404 stays on the existing missing-agents-md presence path — linter runs only when content exists, no regression (bats-covered); (4) bats coverage with stubbed gh_api, no network, shellcheck clean; (5) summary section labelled informational and links to docs/initiatives/agents-md-validation.md. Target-script note: the story names aw-standards-sync.sh, which lives in .github-private; the dev-lead documented this reconciliation in the plan and implementation comments — compliance-audit.sh is the tracked, testable equivalent in this repo and matches the issue title. Deviation is justified.
Findings
No blocking findings. Secret-scan MCP tool unavailable in this run (noted per protocol); the gitleaks CI check passed and the diff contains no secret-like content. Non-blocking observations, all dispositioned by the dev-lead review pass (status=no-changes): (a) gemini flagged mid-test negated assertions ('! grep -q' not as the last statement) that will not trip errexit in bats — a test-robustness nit that weakens two absence assertions but does not affect product behavior; the positive assertions and last-statement negations still hold. (b) codeant flagged '|| true' on the amdl_lint call suppressing linter errors — an accepted trade-off for this informational phase, where a linter failure must not fail the audit. (c) gemini style nit on here-strings in loops. All four open review threads are bot-generated; no human reviewer comments or questions are outstanding, and the prior cascade approval at this same SHA was issued with these threads open.
CI status
All required checks green at db4d069: Lint, ShellCheck, Lint and bats, CodeQL, Analyze (actions), SonarCloud (quality gate passed), Secret scan (gitleaks), Agent Security Scan, AgentShield, duplicate-decl-gate, dependency-audit — all SUCCESS. The CANCELLED/SKIPPED entries are superseded dev-lead dispatch/ci-relay runs, not failures. mergeStateStatus BLOCKED reflects the pending review requirement only.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Cascade: triage → deep (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5)
Summary
Phase 3 (#645) wires the standalone AGENTS.md structural linter into compliance-audit.sh as a strictly informational, non-blocking check: findings go to a separate TSV accumulator (never FINDINGS_FILE), open no issues, never join the umbrella, and cannot fail the run. The sourced dependency scripts/agents-md-lint.sh exists on both head and main and is BASH_SOURCE-guarded so sourcing only defines functions; the linter's 4-field TSV output (level/id/line/text) maps correctly to the recorder's read, and the summary renderer escapes literal pipes. All CI checks pass, SonarCloud quality gate is clean, and downstream impact is (none). The two Gemini advisory findings are minor: BATS negative assertions use ! grep rather than asserting exit status 1 (false-positive risk is only theoretical here since inputs are in-memory here-strings, not files), and a per-repo here-string loop could be an awk pipeline (pure perf, correctness unaffected). No security-sensitive surface, secrets, auth, or injection risk; MCP run_secret_scanning was not available so it was skipped.
Findings
- minor: BATS absence assertions use
! grep -q ...rather thanrun grep -q ...; [ "$status" -eq 1 ]. A grep error (exit 2) would also satisfy the negation and pass falsely. Risk is low here because inputs are in-memory here-strings (grep won't error), but the explicit exit-status-1 form is more robust. Affects the missing-agents-md, org-repo-import-consistency, and heading-hierarchy-valid negative checks. - minor: record_agents_md_structural_findings parses amdl_lint output with a
while ... <<< "$findings"here-string loop; since it runs once per scanned repo, an awk pipeline that prepends the repo name would avoid per-iteration subprocess overhead. Correctness is unaffected — optional optimization only.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: opus 4.8 + duck: o4-mini → audit: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Wires the Phase 2 AGENTS.md structural linter (scripts/agents-md-lint.sh) into the compliance audit as an informational, non-blocking check, plus a downstream org-import-consistency rule. Findings accumulate in a separate TSV (never FINDINGS_FILE), open no issues, never affect the exit code, and surface only in a clearly-labelled summary section linking to the rule-set doc. 266 lines of new bats coverage exercise the real helpers with stubbed gh_api and no network.
Linked issue analysis
Closes #645. All five acceptance criteria are met: (1) linter runs per scanned repo, informational-only; (2) org-repo-import-consistency reported under downstream scope with the canonical .github repo exempt; (3) the 404/presence path is untouched — the linter runs only when content exists; (4) bats tests with stubbed gh_api, shellcheck clean in CI; (5) summary section is labelled informational and links to docs/initiatives/agents-md-validation.md. The story's named target (aw-standards-sync.sh) lives in .github-private; the dev-lead documented the reconciliation on the issue — compliance-audit.sh is the tracked equivalent here, matching the issue title. Both the sourced linter and the ruleset doc were verified present at the head SHA.
Findings
No blocking findings. Notes: (a) amdl_lint stderr/exit suppression (2>/dev/null || true) fails open — intentional for the informational phase, but worth revisiting at the blocking-promotion gate; (b) 4 unresolved advisory bot threads (gemini-code-assist x3 on here-string style and grep-absence assertions, codeant-ai x1 on the error suppression) were reviewed by the dev-lead with a reasoned no-changes status; (c) markdown pipe-escaping in finding messages is handled. Secret-scan MCP tool unavailable in this environment; gitleaks CI check passed.
CI status
All checks green: ShellCheck, Lint and bats, CodeQL, Analyze (actions), Secret scan (gitleaks), Agent Security Scan, SonarCloud, duplicate-decl-gate, dependency-audit. CANCELLED dev-lead dispatch/ci-relay entries are superseded orchestration runs with SUCCESS duplicates.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Wires the standalone AGENTS.md structural linter (scripts/agents-md-lint.sh) into the org compliance audit as an informational, non-blocking check, per issue #645 Phase 3. Findings accumulate in a separate TSV (never FINDINGS_FILE), open no issues, never affect exit code, and surface only in a clearly-labelled informational summary section linking to docs/initiatives/agents-md-validation.md. Includes 12 bats tests (no network) covering scope selection, recording, 404 no-regression, and summary rendering.
Linked issue analysis
Closes #645. All 5 acceptance criteria are substantively addressed: (1) linter runs per-repo, findings recorded informationally with no issues/CI failure; (2) cross-repo import consistency covered via the linter's org-repo-import-consistency rule under downstream scope (.github repo correctly exempt as canonical); (3) missing-AGENTS.md 404 path unchanged — linter runs only when content exists; (4) bats coverage with stubbed gh_api, no network, and ShellCheck CI is green; (5) summary section labelled informational and links to the rule-set doc. Note: the issue's dev notes reference aw-standards-sync.sh, which no longer exists in the repo — compliance-audit.sh is the current org-wide compliance scan, matching the issue title, so the implementation target is correct.
Findings
No blocking findings. Verified: amdl_lint's TSV output (severity/rule/line/message) matches the recorder's parse; sourcing agents-md-lint.sh is safe (CLI guarded behind a BASH_SOURCE check, duplicate-decl-gate green); AMDL_DEFAULT_RULES resolves from the linter's own directory; pipe characters in finding messages are escaped before markdown-table rendering; lint messages are fixed linter strings (not repo-controlled content), limiting injection surface. Non-blocking observations from 4 open bot threads (all assessed by the dev-lead agent at this SHA with explicit no-changes verdicts, followed by donpetry-bot approval): (a) codeant-ai notes 'amdl_lint ... 2>/dev/null || true' would silently mask a broken rule-set file, making the summary claim 'no structural findings' — legitimate but acceptable for a deliberately non-blocking Phase 3 feature, and a broken rules file would fail the bats suite in CI; consider a distinct 'linter unavailable' summary note in a follow-up; (b) gemini nits on here-strings in loops and bats grep-absence exit-code assertions are stylistic.
CI status
All checks green at db4d069: ShellCheck, Lint and bats, CodeQL, SonarCloud (quality gate passed), gitleaks secret scan, Agent Security Scan, AgentShield, duplicate-decl-gate, dependency-audit. The two CANCELLED dev-lead dispatch/ci-relay entries are superseded runs with later successful completions. run_secret_scanning MCP tool not available in this session; gitleaks CI check is green.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Wires the existing AGENTS.md structural linter (scripts/agents-md-lint.sh) into the compliance audit as an informational, non-blocking check per issue #645 Phase 3. Findings accumulate in a separate TSV file (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never fail the run. A clearly-labelled informational summary section renders them as a table with pipe-escaping and links to the rule-set doc. 266 lines of bats coverage exercise scope selection, recording, the 404/presence path, and summary rendering with stubbed gh_api (no network).
Linked issue analysis
Issue #645 is substantively addressed. AC1: linter runs per-repo only when AGENTS.md content is present, informational-only — verified the recorder is a no-op on empty content and the 404 path files missing-agents-md unchanged (AC3, covered by tests). AC2: org-repo-import-consistency applies under downstream scope; the canonical .github repo is correctly exempt. AC4: bats tests are network-free with gh_api stubbed; ShellCheck CI is green. AC5: summary section is labelled informational and links to docs/initiatives/agents-md-validation.md. Note: the issue's dev notes reference aw-standards-sync.sh, but that file does not exist in the repo — the audit flow described (repo enumeration, contents-API fetch, summary accumulation) lives in scripts/compliance-audit.sh, which is where the change correctly landed.
Findings
Cross-verified against the target repo at the head SHA: agents-md-lint.sh exists, defines amdl_lint and AMDL_DEFAULT_RULES, guards its CLI behind a BASH_SOURCE check (sourcing only defines functions), and emits level/id/line/message TSV matching the recorder's parsing exactly.
Four unresolved bot review threads remain, all minor and all explicitly adjudicated by the dev-lead agent with no-changes markers on this SHA:
- gemini: here-strings inside loops — style/perf nit; finding lists are small, negligible impact.
- gemini (x2): bare '! grep -q' absence assertions in bats can silently pass mid-test (the known set -e negation exemption; 'run !' is the robust form). One mid-test instance (missing-agents-md absence check) is a weakened assertion — a test-quality nit, not a shipped-code defect.
- codeant: 'amdl_lint ... 2>/dev/null || true' swallows a rules-file-invalid error, which would render as 'no structural findings'. Acceptable for this informational-only phase; worth surfacing to stderr when findings are promoted to blocking.
Secret scan: the run_secret_scanning MCP tool is not available in this environment; the gitleaks CI check is green. No secrets, auth changes, migrations, workflow changes, or security anti-patterns in the diff. No injection risk: linted content goes through mktemp files and TSV parsing with proper quoting; markdown table cells escape literal pipes.
CI status
All checks green: Lint, ShellCheck, Lint and bats, CodeQL, SonarCloud quality gate, Agent Security Scan, gitleaks secret scan, agent-shield, duplicate-decl-gate all SUCCESS. Remaining entries are SKIPPED ecosystems or superseded/cancelled dispatch relays — no failures.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Confirmation review (triage-approved): integrates the existing AGENTS.md structural linter (scripts/agents-md-lint.sh) into compliance-audit.sh as a strictly informational, non-blocking check, with comprehensive bats coverage. Findings accumulate in a separate TSV file (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never affect the exit code. The 404/missing-file presence path is unchanged. Triage assessment confirmed correct; risk is MEDIUM only because this is non-trivial logic in an org-wide automation script.
Linked issue analysis
Closes #645 ([Phase 3] integrate linter into compliance audit, informational + org-repo import consistency). All acceptance criteria are substantively met: (1) linter runs per scanned repo, findings surfaced in a clearly-labelled informational summary section, no issues opened, no CI failed; (2) org-repo-import-consistency is enforced under the downstream scope and exempted for the canonical .github repo; (3) missing AGENTS.md stays on the existing presence path — the linter only runs when content exists; (4) bats tests are network-free with a stubbed gh_api, and ShellCheck CI is green; (5) the summary section links to docs/initiatives/agents-md-validation.md (verified to exist at this SHA). Note: the issue's dev notes referenced aw-standards-sync.sh, which does not exist on this branch — compliance-audit.sh is the actual org-wide scan and the correct integration point, consistent with the prior cascade review's acceptance at this same SHA.
Findings
No blocking findings.
- Verified scripts/agents-md-lint.sh at this SHA exports amdl_lint and AMDL_DEFAULT_RULES and guards its CLI behind a BASH_SOURCE check, so sourcing it in compliance-audit.sh only defines functions (no side effects).
- record_agents_md_structural_findings is safe: || true on the linter call keeps failures non-blocking, msg is the final read field so embedded tabs cannot mis-split rows, and the temp file is removed.
- append_structural_findings_summary escapes literal pipes in messages so markdown table cells cannot be split (covered by a dedicated test).
- The refactor hoisting the base64 decode in check_agents_md preserves the existing org-reference check behavior exactly.
- Secret scan: the run_secret_scanning MCP tool is not available in this run; the gitleaks CI check passed and the diff contains no credential-like content.
CI status
All quality gates green: ShellCheck, Lint, Lint and bats, CodeQL, Agent Security Scan, Secret scan (gitleaks), SonarCloud quality gate, AgentShield, dependency-audit. Cancelled/skipped entries are superseded dev-lead dispatch and ci-relay automation runs, not quality checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Confirmation review (triage-approved): wires the AGENTS.md structural linter (scripts/agents-md-lint.sh) into compliance-audit.sh as a strictly informational, non-blocking check with a dedicated bats suite. Structural findings accumulate in a separate TSV file (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never affect the exit code. Triage assessment confirmed correct; risk is MEDIUM only because this is non-trivial logic in an org-wide automation script.
Linked issue analysis
Closes #645 ([Phase 3] integrate the linter into the compliance audit, informational + org-repo import consistency). All acceptance criteria are substantively met: (1) the linter runs over each scanned repo's AGENTS.md and findings surface in a clearly-labelled informational summary section — no issues opened, no CI failed; (2) org-repo-import-consistency is checked under the downstream scope, with the canonical .github repo exempt; (3) a 404 stays on the existing missing-agents-md presence path — the linter runs only when content exists; (4) bats coverage is network-free with a stubbed gh_api, and ShellCheck CI is green; (5) the summary links to docs/initiatives/agents-md-validation.md (verified to exist at this SHA). Note: the issue's dev notes referenced aw-standards-sync.sh, which does not exist on this branch — compliance-audit.sh is the actual org-wide scan and the correct integration point (already accepted by the prior review at this same SHA).
Findings
No blocking findings.
- scripts/agents-md-lint.sh exists at this SHA and is sourced (its CLI is guarded behind a BASH_SOURCE check); the passing bats suite, which sources compliance-audit.sh, confirms sourcing is side-effect free.
- record_agents_md_structural_findings is defensive: '|| true' on the linter call keeps failures non-blocking by design, msg is the final read field so embedded tabs cannot mis-split rows, and the mktemp file is removed.
- append_structural_findings_summary escapes literal pipes in messages so markdown table cells are not split (covered by a dedicated test).
- The hoisted base64 decode in check_agents_md preserves the existing org-reference check behavior exactly.
- 4 unresolved review threads are all bot suggestions (3 gemini style nits on here-strings/grep assertions, 1 codeant note about '|| true' — the intentional informational-only design). The dev-lead fix-reviews pass evaluated them and concluded no changes needed; no human-reviewer questions are outstanding.
- Secret scan: the run_secret_scanning MCP tool is unavailable in this run; the gitleaks CI check passed and the diff contains no credential-like content.
CI status
All quality gates green: ShellCheck, Lint, Lint and bats, CodeQL, Agent Security Scan, Secret scan (gitleaks), SonarCloud, AgentShield, duplicate-decl-gate, dependency-audit. Cancelled/skipped entries are superseded dev-lead dispatch and ci-relay automation runs, not quality checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Wires the standalone AGENTS.md structural linter (scripts/agents-md-lint.sh) into compliance-audit.sh as an informational, non-blocking check, plus the downstream org-repo-import-consistency rule, with 12 new bats tests. Findings accumulate in a separate TSV (never FINDINGS_FILE), so they open no issues, never join the umbrella, and never affect the exit code — exactly the Phase 3 mandate. Verified against the head SHA: the sourced linter guards its CLI behind a BASH_SOURCE check; the recorder's 4-field TSV parse matches amdl_lint's level/id/line/message output; org-repo-import-consistency exists in lib/agents-md-rules.json with downstream scope matching the canonical/.github exemption; and docs/initiatives/agents-md-validation.md (the linked rule-set doc) exists.
Linked issue analysis
Closes #645 ([Phase 3] Integrate the linter into the compliance audit). All five acceptance criteria are met: (1) linter runs per scanned repo with findings in a clearly-labelled informational summary section, no issues opened, no CI failed; (2) cross-repo import consistency via the org-repo-import-consistency rule under downstream scope (the pre-existing reference check in check_agents_md is also preserved); (3) the 404/missing-AGENTS.md presence path is unchanged — the linter runs only when content is present, covered by a dedicated test; (4) bats coverage with stubbed gh_api, no network, and ShellCheck CI is green; (5) the summary section links to docs/initiatives/agents-md-validation.md. Note: the issue Dev Notes reference aw-standards-sync.sh, which does not exist in the repo — compliance-audit.sh is the actual org compliance scan and matches the issue title, so the integration point is correct.
Findings
No blocking findings.
- Secret scan: the run_secret_scanning MCP tool is not available in this session; the gitleaks CI check passed. No secrets, credentials, or tokens appear in the diff.
- Markdown-table pipe escaping in finding messages is handled (msg="${msg//|/\|}") and covered by a test.
- Minor (non-blocking): gemini-code-assist suggested replacing the here-string read loop with awk and using explicit grep exit-status checks in the bats negative assertions. Both are style-level; the dev-lead agent triaged them as no-changes-needed, which is reasonable for informational-phase tooling.
- Minor (non-blocking): if amdl_lint errors (e.g. invalid rule-set), the recorder suppresses stderr and no-ops silently — acceptable for an informational phase, worth revisiting when promoted to blocking.
CI status
All checks green at db4d069: ShellCheck, Lint and bats, Secret scan (gitleaks), CodeQL, SonarCloud (quality gate passed), AgentShield, dependency-audit, duplicate-decl-gate. Skipped checks are absent-ecosystem audits; two cancelled dev-lead dispatch/ci-relay runs were superseded by later successful runs of the same jobs.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Phase 3 of the AGENTS.md validation initiative (#645, epic #642): wires the existing structural linter (scripts/agents-md-lint.sh) into scripts/compliance-audit.sh as an informational, non-blocking check, plus a downstream-scope org-repo import-consistency rule. Findings accumulate in a separate TSV (never FINDINGS_FILE), open no issues, never affect the exit code, and surface only in a clearly-labelled informational summary section linking to the rule-set doc. 266 lines of new bats coverage exercise scope selection, recording, the 404/presence path, and summary rendering (including markdown pipe escaping). Triage's low-risk assessment is confirmed; classified MEDIUM here only because it is non-trivial logic in an org-wide audit script.
Linked issue analysis
Issue #645 acceptance criteria are substantively addressed: (1) linter runs over each scanned repo's AGENTS.md, findings recorded informationally in the summary — no issues opened, no failures; (2) cross-repo import-consistency implemented via the org-repo-import-consistency rule under downstream scope, with the canonical .github repo exempt; (3) missing AGENTS.md keeps the existing presence check with no regression — the linter runs only when content exists (verified by test); (4) bats tests use a stubbed gh_api with no network, and ShellCheck CI is green; (5) summary section is labelled informational and links to docs/initiatives/agents-md-validation.md (verified the doc exists on main). Note: the issue body mentions aw-standards-sync.sh, but the integration point used — compliance-audit.sh, where the existing AGENTS.md presence check lives — matches the issue title ("Integrate the linter into the compliance audit") and is the correct home for this check.
Findings
Verified: scripts/agents-md-lint.sh exists on main with amdl_lint, AMDL_DEFAULT_RULES, and the BASH_SOURCE CLI guard, so sourcing it only defines functions as the comment claims. The temp file from mktemp is removed on the success path; TSV parsing is safe (message is the tail field); markdown pipe escaping in the summary table is handled and tested. No security concerns: no secrets, no injection surface (repo names come from the org repo listing, content is base64-decoded to a temp file).
Advisory bot review threads (4 unresolved, all bot-authored, already triaged by the dev-lead fix-bot-comment pass with status=no-changes):
- codeant-ai:
amdl_lint ... 2>/dev/null || truealso suppresses linter execution errors (e.g. a broken rules file), which would render as "no structural findings". This is a deliberate tradeoff for an informational-only phase — never fail the audit — but worth revisiting when the check is promoted to blocking (the promotion gate doc is the right place to track it). - gemini-code-assist: here-string-in-loop style nit and bats grep-absence assertions using
! grep -qrather than asserting exit status 1. Both are stylistic; the current forms are correct for the cases tested.
No unanswered human-reviewer questions. Secret-scan MCP tool not available in this environment — noted and skipped; gitleaks CI check is green.
CI status
All required checks green at db4d069: ShellCheck, Lint and bats, CodeQL, Agent Security Scan, gitleaks secret scan, SonarCloud quality gate, agent-shield, duplicate-decl-gate all SUCCESS. The two CANCELLED entries are superseded dev-lead/dispatch runs, not test checks; SKIPPED entries are ecosystem-audit jobs not applicable to this change.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: db4d069b1b2adce28962aaa550889953c6cf5d58
Review mode: triage-approved (single reviewer)
Summary
Phase 3 of the AGENTS.md validation initiative (#645, epic #642): wires the existing structural linter (scripts/agents-md-lint.sh) into scripts/compliance-audit.sh as an informational, non-blocking check, plus the downstream-scope org-repo-import-consistency rule. Structural findings accumulate in a separate TSV (never FINDINGS_FILE), open no issues, never affect the exit code, and surface only in a clearly-labelled informational summary section linking to the rule-set doc. 266 lines of new bats coverage exercise scope selection, recording, the 404/presence path, FINDINGS_FILE isolation, and summary rendering including markdown pipe escaping. Triage's low-risk assessment is confirmed; classified MEDIUM only because it is non-trivial logic in an org-wide audit script.
Linked issue analysis
Issue #645 acceptance criteria are substantively addressed: (1) the linter runs over each scanned repo's AGENTS.md and findings are recorded informationally — no issues opened, no failures (verified: separate STRUCTURAL_FINDINGS_FILE accumulator, exit code untouched); (2) cross-repo import consistency implemented via org-repo-import-consistency under downstream scope, with the canonical .github repo exempt (tested); (3) missing AGENTS.md keeps the existing presence check — the linter runs only when content exists, and the 404 path is covered by a dedicated test; (4) bats tests stub gh_api with no network, and ShellCheck/bats CI is green; (5) the summary section is labelled informational and links to docs/initiatives/agents-md-validation.md (verified the doc exists on main, 11.8KB). Note: the issue body names aw-standards-sync.sh as the integration point, but the implementation targets compliance-audit.sh — this matches the issue title ('Integrate the linter into the compliance audit') and the existing AGENTS.md presence check lives there, so it is the correct home.
Findings
Independently verified: scripts/agents-md-lint.sh exists on main with amdl_lint (line 361), AMDL_DEFAULT_RULES (line 45), and a BASH_SOURCE CLI guard (line 458), so sourcing it in compliance-audit.sh only defines functions as claimed. The mktemp temp file is created after the empty-content early return and removed on every path (|| true guarantees rm -f runs even on linter error). TSV parsing is safe — the message is the tail read field, so embedded tabs cannot shift columns; markdown pipe escaping in the summary table is handled and tested. No injection surface: repo names come from the org repo listing, content is base64-decoded to a temp file, findings render into a markdown file only.
Four unresolved review threads remain, all bot-authored and already triaged by the dev-lead fix-bot-comment pass (status=no-changes):
- codeant-ai: 'amdl_lint ... 2>/dev/null || true' also swallows linter execution errors (broken rules file would render as 'no structural findings'). A deliberate tradeoff for the informational-only phase — worth revisiting at the informational-to-blocking promotion gate.
- gemini-code-assist (x3): here-string-in-loop style nit and bats grep-absence assertion style. Stylistic; the current forms are correct for the cases tested.
No unanswered human-reviewer questions. Secret-scan MCP tool not available in this environment — skipped; no secret-like content in the diff, and the gitleaks CI check is green.
CI status
All required checks green at db4d069: ShellCheck lint, Lint and bats, CodeQL (actions), agent-shield, add-to-project, dependency-audit detect, SonarCloud quality gate, CodeRabbit all SUCCESS. The two CANCELLED entries (dev-lead / dispatch, dev-lead / ci-relay) are superseded agent-dispatch runs, not test checks; SKIPPED entries (dependabot-automerge, pr-review-mention) are not applicable to this change. mergeStateStatus BLOCKED reflects branch-protection review requirements, not failing checks.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Superseded by automated re-review at db4d069.
Superseded by automated re-review at
|
Superseded by automated re-review at db4d069.
Superseded by automated re-review at
|
Superseded by automated re-review at
|
Dev-Lead — review-changes (applied)Changes committed and pushed. |
|
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 0147eb3bddbb317023440c2e48f7504308044d37
Review mode: triage-approved (single reviewer)
Summary
Phase 3 of epic #642: wires the AGENTS.md structural linter (amdl_lint, sourced from scripts/agents-md-lint.sh) into compliance-audit.sh as a strictly informational check. Findings accumulate in a separate TSV (never FINDINGS_FILE), open no issues, never fail the run, and render as a clearly-labelled informational summary section linking to docs/initiatives/agents-md-validation.md. All 4 review-thread findings from the prior cycle are resolved: the bats no-op negation assertions (! grep -q) were replaced with the run grep + status-eq-1 pattern, and the here-string read loop was refactored into a single awk pipeline. The codeant error-suppression thread was resolved in-thread (deliberate never-fail-the-audit posture, consistent with the issue's informational-only mandate). 270 lines of mocked, no-network bats coverage.
Linked issue analysis
Closes #645 — all acceptance criteria substantively met: (1) linter runs per scanned repo, findings surface in an informational non-blocking summary section; (2) org-repo-import-consistency runs under downstream scope with the canonical .github repo exempt (agents_md_lint_scope_for_repo, tested); (3) the missing-AGENTS.md 404 presence path is unchanged and the linter runs only when content exists (tested); (4) bats coverage is mocked/no-network, ShellCheck green; (5) summary section labelled informational and links to the rule-set doc (verified to exist on main). Both sourced dependencies (scripts/agents-md-lint.sh, docs/initiatives/agents-md-validation.md) verified present on main.
Findings
Prior-cycle findings — all resolved:
- gemini (bats mid-test
! grep -qno-op assertions) — fixed: all three sites now userun grep -q …; [ "$status" -eq 1 ]. Thread resolved. - gemini (here-string in read loop) — fixed: recorder refactored to a single
amdl_lint | awkpipeline appending directly to the accumulator. Thread resolved. - codeant (
2>/dev/null … || truesuppresses linter errors) — resolved in-thread: deliberate never-fail-the-audit posture per the Phase 3 informational-only mandate; documented in code comments.
New commits since prior review (db4d069b): a merge of main (brings in unrelated PR #1059) plus the review-changes commit above. No new issues introduced — the awk pipeline preserves the TSV contract (repo, severity, rule, line, message), filters empty rows ($2 != ""), and the || true guard keeps the audit green under pipefail. Markdown pipe-escaping in the summary table retained and tested.
Secret scan: run_secret_scanning MCP tool not available in this session; gitleaks CI check passed. No secrets in the diff.
CI status
All checks green at head: ShellCheck, Lint, Lint and bats, CodeQL (actions), Secret scan (gitleaks), SonarCloud Quality Gate, Agent Security Scan, AgentShield, duplicate-decl-gate, npm audit, pr-auto-review — all SUCCESS. Two early dev-lead ci-relay/dispatch runs show CANCELLED but were superseded seconds later by a SUCCESS dispatch and an expected-SKIPPED ci-relay ([skip ci-relay] commit); conditional dependency-audit jobs skipped as expected.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 0147eb3bddbb317023440c2e48f7504308044d37
Review mode: triage-approved (single reviewer)
Summary
Confirms the triage assessment: this PR wires the standalone AGENTS.md structural linter (scripts/agents-md-lint.sh) into the compliance audit as an informational-only check, plus an org-repo import-consistency rule. Findings accumulate in a separate TSV (never FINDINGS_FILE), open no issues, never affect the exit code, and surface only in a clearly-labelled summary table with pipe-escaping for cell safety. 270 lines of the 377 added are bats tests. Risk is MEDIUM rather than LOW (non-trivial logic in a CI-executed shell script), but all decision gates pass.
Linked issue analysis
Closes #645 ([Phase 3] Integrate the linter into the compliance audit). All acceptance criteria are substantively addressed: (1) linter runs per scanned repo, findings recorded informationally in the summary; (2) org-repo-import-consistency runs under downstream scope, with the canonical .github repo exempt; (3) the missing-AGENTS.md presence check is regression-tested — the linter runs only when the file exists (404 path untouched); (4) 13 bats tests with stubbed gh_api, no network; ShellCheck CI is green; (5) the summary section is labelled informational and links to the rule-set/promotion-gate doc. Note: AC text names aw-standards-sync.sh, but the issue title and implementation both target the compliance audit (scripts/compliance-audit.sh) — consistent with the issue's actual intent.
Findings
No blocking findings.
- All 4 prior review threads (gemini-code-assist ×3, codeant-ai ×1) are resolved, each with a substantive owner response: the here-string loop was replaced with a direct
amdl_lint | awkpipeline, both negative-grep assertions now assert exit status 1 exactly, and the2>/dev/null || trueerror suppression is a documented Phase 3 informational-only tradeoff (hard error propagation deferred to the Phase 4 blocking gate). - No unanswered human-reviewer questions; the owner authored the thread replies.
- Markdown-injection surface in the summary table is mitigated by pipe-escaping; linter messages are rule-defined, not raw file content.
- Secret-scanning MCP tool unavailable in this run; the gitleaks CI check passed.
CI status
All checks green: ShellCheck, Lint, Lint and bats, CodeQL, Analyze (actions), SonarCloud, Secret scan (gitleaks), Agent Security Scan, agent-shield, duplicate-decl-gate, CodeRabbit, dependency-audit — all SUCCESS. The lone CANCELLED dev-lead / dispatch and ci-relay entries are superseded agent-dispatch runs with later SUCCESS instances of the same checks; not test/lint failures.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
User description
Closes #645
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Add advisory AGENTS.md structure checks to compliance audits
What Changed
AGENTS.mdfiles for structural issues and repository import consistency.AGENTS.mdfiles continue to use the existing blocking check.AGENTS.mdfiles, including safe summary formatting.Impact
✅ Clearer AGENTS.md compliance guidance✅ No audit failures from advisory structure issues✅ Traceable structural findings in audit summaries💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.