Repository navigation
chore: delete stray codeql.yml workflow - #107
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRemoved the stray GitHub Actions CodeQL workflow file to align with organization standards that mandate use of GitHub-managed CodeQL default setup. The per-repo workflow created duplicate analysis runs alongside the managed solution. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Self-review complete — change is a single file deletion with no surprises:
@don-petry — you're listed in CODEOWNERS. Please review and merge to finally close this compliance finding. Once merged, Dependabot will no longer open bump PRs for |
Outdated review (superseded by re-review at
|
Outdated review (superseded by re-review at
|
| Check | Result |
|---|---|
| Analyze (actions) | ✅ SUCCESS |
| CodeQL | ✅ SUCCESS |
| CodeRabbit | ✅ SUCCESS |
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
![petry-projects-pr-review-agent[bot]](https://avatars.githubusercontent.com/u/258516906?s=60&v=4){kind=small}
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)
Summary
This PR deletes the per-repo .github/workflows/codeql.yml, which only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. All CI gates pass, the org-managed CodeQL check confirms no scanning gap, and the sole new commit since the prior approval is a no-op retrigger. Triage escalated only because its output was invalid, not due to any substantive concern in the PR.
Findings
- [INFO] ci-security (
.github/workflows/codeql.yml): Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity. - [INFO] security-hygiene (
.github/workflows/codeql.yml): Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct practice. No security smell in the removed code. - [INFO] re-review: The substantive deletion (sha 8bb5f56) was already reviewed and approved twice. The current head (86cccd9) adds only a 'retrigger: bump workflows to run checks' commit with no code changes.
- [MINOR] process: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' or restricting Dependabot from opening bump PRs for this path to prevent recurrence.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. All CI gates pass (Lint, Format, CodeQL Analyze, SonarCloud, AgentShield, CodeRabbit), and the org-managed CodeQL check confirms no security scanning gap. Triage escalated solely due to an invalid triage output, not any substantive concern in the PR.
Findings
- INFO: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- INFO: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- INFO: The substantive deletion (sha 8bb5f56) was already reviewed and approved in two prior cycles. The current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes.
- MINOR: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at the .github/workflows/codeql.yml path to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. All CI gates pass (Lint, Format, CodeQL Analyze, SonarCloud, AgentShield, CodeRabbit), and the org-managed CodeQL check confirms no security scanning gap. Triage escalated solely due to an invalid triage output; the only new commit since the last approval is a no-op retrigger with no code changes.
Findings
- INFO: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- INFO: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- INFO: The substantive deletion (sha 8bb5f56) was already reviewed and approved four times by the PR-review cascade. The current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes.
- MINOR: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at the .github/workflows/codeql.yml path to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo CodeQL workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. Triage escalated solely due to an invalid triage output, not any substantive concern. All CI gates pass (Lint, Format, CodeQL Analyze, SonarCloud, AgentShield, CodeRabbit), the org-managed CodeQL confirms no scanning gap, and the head SHA (86cccd9) was already approved five times by the review cascade.
Findings
- info: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- info: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- info: The substantive deletion (sha 8bb5f56) was already reviewed and approved five times by the PR-review cascade on the current head (86cccd9). The only new commit since last approval is a no-op 'retrigger: bump workflows to run checks' with no code changes.
- minor: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at the .github/workflows/codeql.yml path to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. Triage escalated solely because its output was invalid, not due to any substantive concern. All CI gates pass, org-managed CodeQL (Analyze (actions)) confirms no security scanning gap, and the current head (86cccd9) adds only a no-op retrigger commit atop a deletion already approved in prior review cycles.
Findings
- INFO: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- INFO: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- INFO: The substantive deletion (sha 8bb5f56) was already reviewed and approved multiple times by the PR-review cascade. Current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes.
- MINOR: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at the .github/workflows/codeql.yml path to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo CodeQL workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. Triage escalated solely because its output was invalid (triage-output-invalid signal), not due to any substantive concern in the PR. All CI gates pass (Lint, Format, CodeQL Analyze (actions), SonarCloud, AgentShield, CodeRabbit) and the org-managed CodeQL confirms no security scanning gap. This head SHA (86cccd9) was already approved multiple times by the review cascade.
Findings
- INFO: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- INFO: Deleted workflow used pinned SHA references for all action steps (checkout@de0fac2e, codeql-action/init@95e58e9a, codeql-action/analyze@95e58e9a) — correct security practice. No security smell in the removed code.
- INFO: The substantive deletion (sha 8bb5f56) was reviewed and approved in prior cycles. Current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes. Triage-only escalation signal was triage-output-invalid.
- MINOR: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at .github/workflows/codeql.yml to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo CodeQL workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. Triage escalated solely due to an invalid triage output (triage-output-invalid), not any substantive concern. All CI gates pass (Lint, Format, CodeQL Analyze (actions), SonarCloud, AgentShield, CodeRabbit) and the head SHA (86cccd9) has already been reviewed and approved multiple times by the PR-review cascade.
Findings
- info: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- info: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- info: The substantive deletion (sha 8bb5f56) was already reviewed and approved multiple times by the PR-review cascade. Current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes. Triage escalated only due to triage-output-invalid, not a substantive signal.
- minor: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at .github/workflows/codeql.yml to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR #107 deletes .github/workflows/codeql.yml, a per-repo CodeQL workflow that only scanned the 'actions' ecosystem and duplicated the org-managed CodeQL default setup. Triage escalated solely due to an invalid triage output (triage-output-invalid signal), not any substantive concern. All CI gates pass (Lint, Format, CodeQL Analyze (actions), SonarCloud, AgentShield, CodeRabbit) and this head SHA (86cccd9) has already been reviewed and approved multiple times by the PR-review cascade.
Findings
- info: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- info: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- info: The substantive deletion (sha 8bb5f56) was already reviewed and approved multiple times by the PR-review cascade. The current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes. Triage escalated only due to triage-output-invalid, not a substantive signal.
- minor: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at .github/workflows/codeql.yml to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 86cccd9cec828d4a16f7decb5fcff49b642f7e6c
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
Findings
- INFO: Deleted workflow only scanned the 'actions' language ecosystem — no source-code security scanning is lost. Org-managed CodeQL (Analyze (actions)) passes in CI, confirming continuity.
- INFO: Deleted workflow used pinned SHA references for all action steps (checkout, codeql-action/init, codeql-action/analyze) — correct security practice. No security smell in the removed code.
- INFO: The substantive deletion (sha 8bb5f56) was already reviewed and approved multiple times by the PR-review cascade. The current head (86cccd9) adds only a no-op 'retrigger: bump workflows to run checks' commit with no code changes. Triage escalated only due to triage-output-invalid, not a substantive signal.
- MINOR: This is the fourth attempt to remove this file (#76, #85, #97 went unmerged). After merging, consider adding a Dependabot ignore entry for 'github/codeql-action' at .github/workflows/codeql.yml to prevent Dependabot from re-introducing the file.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
Automated review — human attention neededThis PR has been through 11 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops. Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the Posted by the don-petry PR-review cascade. |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
9ebb780 to
04c5268
Compare
|
There was a problem hiding this comment.
Pull request overview
Deletes the stray .github/workflows/codeql.yml workflow to comply with the org standard that uses GitHub-managed CodeQL default setup. The removed file had no custom query packs, build modes, or path filters that would require an exception.
Changes:
- Removes
.github/workflows/codeql.ymlentirely
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
* chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com>
* chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com>
…deation.yml-permissions (#371) * Add Claude Code GitHub Action (#5) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings (#12) * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#8) - Scope workflow token permissions (#9) - Add Dependabot configuration (#10) - Ensure SAST runs on all commits (#11) Closes #8, #9, #10, #11 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use correct CodeQL action commit SHA The previous SHA was invalid. Updated to the actual v3 commit SHA. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Add actions: read to CodeQL workflow permissions - Add concrete security contact email to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 3.35.1 to 4.35.1 (#15) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump actions/checkout from 4.2.2 to 6.0.2 (#16) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.2 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4.2.2...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump anthropics/claude-code-action from 1.0.80 to 1.0.81 (#13) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.81. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...e7b588b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.81 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#30) Add issues:[labeled] event trigger and claude label support so Claude can work issues autonomously — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input - Add dependabot skip condition on step - Add permission comment for contents: write Matches the standard defined in petry-projects/.github#24. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#31) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#39) * feat: split Claude workflow into interactive + issue automation jobs Aligns with the org standard in petry-projects/.github. The claude-issue job runs in automation mode with tools to create PRs, self-review, check CI, and tag code owners when ready. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#40) * feat: add workflow to create code-quality repository ruleset Creates the required 'code-quality' branch ruleset with SonarCloud as a required status check on the default branch. This workflow runs on every push to main (idempotent) to ensure the ruleset stays in sync. Closes #28 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * revert: remove workflow approach - cannot push workflow files * chore(workflows): adopt centralized stubs from petry-projects/.github (#52) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): Bump github/codeql-action from 4.35.1 to 4.35.2 (#84) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#114) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#114)" This reverts commit d49958d. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore(deps): Bump github/codeql-action from 4.35.2 to 4.35.3 (#122) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * chore(deps): Bump github/codeql-action from 4.35.3 to 4.35.4 (#138) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore: delete stray codeql.yml workflow (#107) * chore: delete stray codeql.yml workflow The org now uses GitHub-managed CodeQL default setup. Per-repo workflow files are drift and run duplicate analysis alongside the default setup. This file contained no custom query packs, build modes, or path filters that would warrant an exception. Closes #66 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * ci: remove drift codeql.yml — GitHub-managed default setup is active (#98) retrigger: bump workflows to run checks Co-authored-by: Claude <claude@anthropic.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#156) * fix(compliance): enable delete_branch_on_merge repository setting (#102) * fix(compliance): enable delete_branch_on_merge repository setting Apply the `delete_branch_on_merge` repository setting required by org standards (standards/github-settings.md#merge-settings). This is a repository-level setting applied via the GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin \ -f delete_branch_on_merge=true # confirmed: true Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: update code-quality ruleset to full required check list (#100) * fix: update code-quality ruleset to full required check list Add all required status checks to scripts/setup-rulesets.sh: - SonarCloud, Analyze (actions), Lint, Format - agent-shield / AgentShield, dependency-audit / Detect ecosystems Explicitly excludes claude-code / claude (see comment) to avoid deadlocking workflow-modifying PRs. Also enables strict_required_status_checks_policy to match the live ruleset. Closes #81 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix(compliance): enable delete_branch_on_merge repository setting (#95) * fix(compliance): enable delete_branch_on_merge repository setting The repository setting `delete_branch_on_merge` must be enabled per org standards (standards/github-settings.md#repository-settings--standard-defaults). Applied via GitHub API: gh api -X PATCH repos/petry-projects/ContentTwin -f delete_branch_on_merge=true This is a repository-level setting, not a file change. The next weekly compliance audit will verify the fix and auto-close this finding. Closes #62 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * fix: pin dependabot-automerge reusable workflow to SHA (#90) * fix: pin dependabot-automerge reusable workflow to SHA Pins petry-projects/.github reusable workflow from @v1 to commit SHA ee22b427cbce9ecadcf2b436acb57c3adf0cb63d (v1) to satisfy the action-pinning policy. Closes #58. Co-authored-by: don-petry <don-petry@users.noreply.github.com> * retrigger: bump workflows to run checks --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> * feat: implement issue #146 — Compliance: secret_scanning_non_provider_patterns (#170) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #134 — Compliance: check-suite-auto-trigger-347564 (#167) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #147 — Compliance: dependabot_security_updates (#166) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #132 — Compliance: non-stub-dependabot-rebase.yml (#165) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #143 — Compliance: non-stub-dependabot-automerge.yml (#164) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #133 — Compliance: check-suite-auto-trigger-1236702 (#172) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #142 — Compliance: codeowners-org-leads-not-first (#163) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #174 — [Fleet Monitor] petry-projects/ContentTwin — dev-lead.yml (#175) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #131 — Compliance: codeowners-no-catchall (#162) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #144 — Compliance: non-stub-pr-review-mention.yml (#177) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#211) * rollout: deploy pr-review-mention standard workflow * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: correct pr-auto-review reusable workflow reference (#219) * fix: correct pr-auto-review reusable workflow reference * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow (#222) Co-authored-by: Claude Code Bot <noreply@anthropic.com> * feat: implement issue #205 — Compliance: gitignore_secrets_block (#230) * feat: implement issue #205 — Compliance: gitignore_secrets_block * chore: apply manual instructions [skip ci-relay] * chore: apply manual instructions [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable (#291) * feat: implement issue #286 — Compliance: check-suite-prefs-unreadable * chore: apply manual instructions [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github (#293) * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * chore: sync 6 org-standard workflow stub(s) from petry-projects/.github * fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#308) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#327) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#328) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #342 — Compliance: dev-lead-stub-agent-ref (#349) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#366) * chore: insert org secrets baseline in .gitignore * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #346 — Compliance: stub-surface-drift-feature-ideation.yml-permissions * chore: dev-lead update (review-changes) [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix: restore secrets-baseline END sentinel and add-to-project trailing newline Reverts two accidental truncation hunks unrelated to issue #346, per the automated review: .gitignore's org-managed secrets-baseline closing sentinel must not be edited, and the add-to-project.yml stub newline removal was pointless drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: Claude <claude@anthropic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Summary
.github/workflows/codeql.ymlto bring the repo into compliance with the org standard for GitHub-managed CodeQL default setupWhy this keeps coming back
Dependabot PR #84 bumped
github/codeql-actioninside the workflow file and was merged, which re-introduced the file after prior deletion PRs were created but not yet merged. Once this PR is merged, the file will be gone and Dependabot will no longer open bump PRs for it.Closes #66
Generated with Claude Code
Summary by CodeRabbit