chore: sync 8 org-standard workflow stub(s) from petry-projects/.github by don-petry · Pull Request #387 · petry-projects/broodly

don-petry · 2026-07-13T11:48:42Z

Syncs the following org-standard workflow stub(s) from petry-projects/.github (standards/workflows/), deployed verbatim:

pr-review-mention.yml
dev-lead.yml
agent-shield.yml
auto-rebase.yml
dependabot-automerge.yml
dependabot-rebase.yml
dependency-audit.yml
add-to-project.yml

Opened by scripts/deploy-standard-workflows.sh. Stubs are thin callers; all behaviour lives in the reusables. See standards/ci-standards.md. Labeled standards-sync and left for the normal review/auto-merge pipeline — the deploy script never merges directly.

chatgpt-codex-connector · 2026-07-13T11:48:46Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

coderabbitai · 2026-07-13T11:48:57Z

Warning

Review limit reached

@don-petry, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 46 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 78caca64-9927-451a-85f0-d6e6efedeca8

📥 Commits

Reviewing files that changed from the base of the PR and between a2dc6d1 and c558648.

📒 Files selected for processing (8)

.github/workflows/add-to-project.yml
.github/workflows/agent-shield.yml
.github/workflows/auto-rebase.yml
.github/workflows/dependabot-automerge.yml
.github/workflows/dependabot-rebase.yml
.github/workflows/dependency-audit.yml
.github/workflows/dev-lead.yml
.github/workflows/pr-review-mention.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch standards-sync/workflows-20260713

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

gemini-code-assist · 2026-07-13T11:49:10Z

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

don-petry · 2026-07-13T11:49:55Z

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

sonarqubecloud · 2026-07-13T11:50:04Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

donpetry-bot · 2026-07-13T11:50:40Z

Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-07-13T12:50:40Z.

don-petry · 2026-07-13T11:51:53Z

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: 8 workflow YAML files
Skipped (informational): 0
Status: No action required — Quality Gate passed with zero findings
```

donpetry-bot

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: c558648d603f6b52c04af379e0a76ab37abf1823
Review mode: triage-approved (single reviewer)

Summary

Automated standards-sync PR deploying 8 org-standard workflow caller stubs from petry-projects/.github (standards/workflows/). Verified byte-identical to the source of truth at main, modulo the channel pins (*/stable → */v2-stable; dev-lead → dev-lead/v1-stable incl. matching agent_ref), which the stub headers explicitly designate as the only permitted per-repo variance. All 7 new channel tags were confirmed to exist in the source repos via the GitHub API, and the workflows exercised on this PR (AgentShield, dependency-audit, dev-lead) ran green under the new refs. Confirms the triage tier's low-risk assessment.

Linked issue analysis

No linked issues (closingIssuesReferences is empty). This is an automated sync opened by scripts/deploy-standard-workflows.sh; tracking lives in petry-projects/.github#387 and #415 as referenced in the stub headers. No issue linkage required.

Findings

No blocking findings.

Verbatim-sync check: all 8 files identical to standards/workflows/ at main except the documented ring/channel pins.
Channel tags agent-shield/v2-stable, auto-rebase/v2-stable, dependabot-automerge/v2-stable, dependabot-rebase/v2-stable, dependency-audit/v2-stable, pr-review-mention/v2-stable (petry-projects/.github) and dev-lead/v1-stable (petry-projects/.github-private) all exist.
Security posture: explicit minimal permissions retained; secrets passed explicitly where the standard requires (add-to-project, dependabot-rebase); discussion trigger removed from add-to-project (narrows surface); moving channel refs are first-party and carry the documented NOSONAR(githubactions:S7637) exemption per ci-standards.md.
Secret scan: run_secret_scanning MCP tool unavailable in this run; gitleaks CI check passed and the diff contains no secret-like content.
Advisory bots (CodeRabbit, Codex) were rate-limited and Gemini cannot review workflow YAML; their input is advisory only and does not gate this verdict. All substantive analysis was performed directly.

CI status

All required checks green at c558648: CI (TypeScript, Go, gitleaks secret scan), CodeQL (actions, go, javascript-typescript), AgentShield, SonarCloud Quality Gate passed (0 new issues, 0 hotspots), dependency-audit (govulncheck, pnpm audit; others skipped as not applicable), add-to-project, dev-lead dispatch. No failing or pending checks.

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

donpetry-bot

Automated review — APPROVED ✓

Risk: MEDIUM
Reviewed commit: c558648d603f6b52c04af379e0a76ab37abf1823
Review mode: triage-approved (single reviewer)

Summary

Automated standards-sync PR deploying 8 org-standard workflow caller stubs from petry-projects/.github (standards/workflows/). Re-review after an earlier advisory-bot rate-limit hold; confirms the triage tier's low-risk assessment and the prior single-reviewer approval at this same SHA. Independently re-verified: stubs match the source of truth at main byte-for-byte except the ring/channel pins (*/stable → */v2-stable; dev-lead → dev-lead/v1-stable with matching agent_ref), which the stub headers designate as the only permitted per-repo variance, and all 7 new channel tags exist in the source repos.

Linked issue analysis

No linked issues (closingIssuesReferences is empty). This is an automated sync opened by scripts/deploy-standard-workflows.sh; tracking lives in petry-projects/.github#387 and #415 as referenced in the stub headers. No issue linkage required.

Findings

No blocking findings.

Verbatim-sync check (spot-checked 4 of 8 files against petry-projects/.github standards/workflows/ at main): identical except the documented ring/channel pins.
Channel tags agent-shield/v2-stable, auto-rebase/v2-stable, dependabot-automerge/v2-stable, dependabot-rebase/v2-stable, dependency-audit/v2-stable, pr-review-mention/v2-stable (petry-projects/.github) and dev-lead/v1-stable (petry-projects/.github-private) all verified to exist via the GitHub API.
Security posture: no permissions broadened; add-to-project drops the discussion trigger (narrows surface) and keeps explicit secret passing; moving channel refs are first-party with the documented NOSONAR(githubactions:S7637) exemption per ci-standards.md.
Secret scan: run_secret_scanning MCP tool unavailable in this run; gitleaks CI check passed and the diff contains no secret-like content.
No unresolved review threads or unanswered human questions; remaining comments are advisory-bot rate-limit notices (CodeRabbit, Codex) and dev-lead no-change statuses, none of which gate this verdict.

CI status

All checks green at c558648: CI (TypeScript, Go, gitleaks secret scan), CodeQL (actions, go, javascript-typescript), AgentShield, SonarCloud Quality Gate passed (0 new issues, 0 hotspots), dependency-audit (govulncheck, pnpm audit green; cargo/pip/npm skipped as not applicable), add-to-project, dev-lead dispatch, pr-auto-review. Skipped jobs are conditional paths, not failures. No failing or pending checks.

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

…ub (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

@claude

…uire_code_owner_review (#433) * Add BMAD method workspace and resume beekeeping brainstorming session * Add product brief for bmad-method outlining core vision, user journeys, and success metrics * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add zero-tap beeyard experience — core differentiator MAJOR: Broodly's key differentiator is now a zero-tap beeyard session. Once inspection starts, the user NEVER needs to tap the phone in the field. New FRs: - FR19c: Continuous multi-hive voice session (zero-tap, voice navigation) - FR19d: Per-hive context during multi-hive session (auto-save, TTS announce) - FR30c: Post-session Evening Review (tap-friendly at home) - FR19 updated: session-based not per-hive - FR27 updated: hive navigation commands (next/move to/which/how many/end) New stories: 8.8 (multi-hive voice session), 8.9 (evening review) Total: 64 stories across 12 epics Prototype: 30 screens (+3 new) - inspection-next-hive: voice transition between hives with context - inspection-session-end: session summary with stats - evening-review: tap-friendly per-hive correction UI - Homepage: "Review today's session" card added CLAUDE.md: Zero-Tap Beeyard section added as key differentiator UX spec: Continuous session + evening review patterns added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Goal slider, scale weights, card variants, voice-top plan, materials list 1. Goal Selection: replaced multi-select chips with Honey↔Splits sliding scale (competing priorities). Removed Learning/Growth. Colony health always prioritized. FR2b updated. 2. Homepage: added regional scale weight card (beecounted.org) showing daily weight trend for user's area. New FR10a, FR11c. 3. Design system: actionable cards (amber left border + chevron + hover) vs informational cards (no affordance). Applied across all prototype screens. CLAUDE.md + PRD updated. 4. Weekly Plan: Live Discussion Mode banner moved to top — users can start talking immediately. FR13 updated. 5. Weekly Plan: Required Materials checklist before apiary accordions (treatments, equipment, syrup). New FR13a. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add coding standards, Live Mode icon, notification types, and UX refinements Update CLAUDE.md with coding standards section (org standards + Broodly-specific guidelines for TypeScript, Go, and monorepo). Update PRD with FR12b2 (persistent Live Mode EQ icon), FR30c (photos/videos in Evening Review), FR40/FR40a2 (per-category notification toggles and types screen). Update UX spec with icon conventions, notification types screen, and Live Mode activation from app header. Add Live Mode icon exploration HTML files and test framework spec. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Add AGENTS.md with full project rules, slim down CLAUDE.md Follows the org convention where AGENTS.md is the comprehensive agent-agnostic file and CLAUDE.md is a Claude Code-specific summary with @import for org-wide standards. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bee87b3...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897e. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * fix: use explicit secrets and write permissions in dependabot-rebase workflow (#170) * fix: use explicit secrets and write permissions in dependabot-rebase workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs. * fix: pin reusable SHA, update header guidance, fix secrets comment Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets * fix: apply prettier formatting (single space before inline comments) * fix: apply prettier formatting to auto-rebase.yml (single space before inline comments) * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * feat: implement issue #243 — [Fleet Monitor] petry-projects/broodly — ci-failure-analyst.yml (#297) * fix(deps): pin shell-quote to >=1.8.4 to patch GHSA-w7jw-789q-3m8p Critical CVE in shell-quote <=1.8.3 allows newline injection via object .op values. Added pnpm override to force >=1.8.4 and regenerated pnpm-lock.yaml with the patched version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(deps): broaden dependency overrides to patch nested vulnerabilities Tightened pnpm dependency overrides from pattern-based constraints (e.g. tmp@<0.2.6) to unconditional versions (tmp, uuid) to ensure deeply nested vulnerable packages (e.g., tmp@0.0.33 via patch-package, js-yaml@3.14.2 via Babel/Jest) are properly patched. This resolves 5 pnpm audit violations (1 high, 3 moderate, 1 low) and regenerates pnpm-lock.yaml accordingly. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: sync org-standard pr-review-mention.yml stub from petry-projects/.github (#333) * chore: sync org-standard auto-rebase.yml stub from petry-projects/.github (#335) * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#359) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml (#397) * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: fix pnpm v11 lockfile mismatch and add @types/jest [skip ci-relay] Move overrides authority from the now-ignored package.json pnpm.overrides field to pnpm-workspace.yaml (aligned with lockfile keys). Add @types/jest as an explicit devDependency to apps/mobile so TypeScript can resolve test globals under pnpm's strict node_modules isolation. Add "types": ["jest"] to apps/mobile/tsconfig.json. Regenerate lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove unused test scripts from workspace packages Packages config, domain-types, graphql-types, test-utils, and ui have test scripts that invoke jest but contain no test files and jest is not in their devDependencies. This causes test failure when pnpm run test is executed recursively. Remove the unused scripts since these packages are type/domain libraries with no unit test coverage. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #410 — Compliance: dev-lead-stub-pin (#412) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#437) * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github (#440) * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * fix(reviews): address review comments [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Don Petry <don@petry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>

…ub (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

…uire_last_push_approval (#432) * Add BMAD method workspace and resume beekeeping brainstorming session * Update brainstorming session document with completed steps and new ideas generated * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...c10b8064de6f491fea524254123dbe5e09572f13) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/bee87b3258c251f9279e5371b0cc3660f37f3f77...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897ec9aa9a0e84c0cc1b3ad29f0f6cf1748f7. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * fix: use explicit secrets and write permissions in dependabot-rebase workflow (#170) * fix: use explicit secrets and write permissions in dependabot-rebase workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs. * fix: pin reusable SHA, update header guidance, fix secrets comment Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets * fix: apply prettier formatting (single space before inline comments) * fix: apply prettier formatting to auto-rebase.yml (single space before inline comments) * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#437) * Add BMAD method workspace and resume beekeeping brainstorming session * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add MVP epics (12), stories (62), and sprint status tracking - 12 epics sequenced per architecture implementation order: scaffolding, auth, DB, GraphQL, mobile shell, onboarding, apiary/hive CRUD, guided inspection, recommendations, planning, voice/media pipeline, notifications - 62 stories with TDD requirements (tests-first for every story) - All 58 FRs mapped to implementation stories - Sprint status YAML for tracking (all items at backlog) - Estimated scope: 94-135 implementation days Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add all 62 stories (Epics 2-12) ready-for-dev with TDD requirements Complete implementation blueprint — all 12 epics, 62 stories: - Epic 2: Auth & Identity (5 stories) — Firebase, JWT, RBAC - Epic 3: Database Schema (5 stories) — PostgreSQL, migrations, sqlc - Epic 4: GraphQL Schema (5 stories) — gqlgen, recommendation contract - Epic 5: Mobile App Shell (5 stories) — Expo Router, Apollo, Zustand - Epic 6: Onboarding (5 stories) — Welcome through disclaimer - Epic 7: Apiary/Hive CRUD (6 stories) — Health cards, collaborators - Epic 8: Guided Inspection (7 stories) — Voice, photo, AI, summary - Epic 9: Recommendations (5 stories) — Context, Gemini, confidence - Epic 10: Planning (5 stories) — Homepage, weekly queue, calendar - Epic 11: Voice/Media Pipeline (5 stories) — Upload, STT, embeddings - Epic 12: Notifications (5 stories) — Dispatch, escalation, feedback Sprint status reconciled: all epics in-progress, all stories ready-for-dev. Every story includes TDD requirements (tests-first). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add zero-tap beeyard experience — core differentiator MAJOR: Broodly's key differentiator is now a zero-tap beeyard session. Once inspection starts, the user NEVER needs to tap the phone in the field. New FRs: - FR19c: Continuous multi-hive voice session (zero-tap, voice navigation) - FR19d: Per-hive context during multi-hive session (auto-save, TTS announce) - FR30c: Post-session Evening Review (tap-friendly at home) - FR19 updated: session-based not per-hive - FR27 updated: hive navigation commands (next/move to/which/how many/end) New stories: 8.8 (multi-hive voice session), 8.9 (evening review) Total: 64 stories across 12 epics Prototype: 30 screens (+3 new) - inspection-next-hive: voice transition between hives with context - inspection-session-end: session summary with stats - evening-review: tap-friendly per-hive correction UI - Homepage: "Review today's session" card added CLAUDE.md: Zero-Tap Beeyard section added as key differentiator UX spec: Continuous session + evening review patterns added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Goal slider, scale weights, card variants, voice-top plan, materials list 1. Goal Selection: replaced multi-select chips with Honey↔Splits sliding scale (competing priorities). Removed Learning/Growth. Colony health always prioritized. FR2b updated. 2. Homepage: added regional scale weight card (beecounted.org) showing daily weight trend for user's area. New FR10a, FR11c. 3. Design system: actionable cards (amber left border + chevron + hover) vs informational cards (no affordance). Applied across all prototype screens. CLAUDE.md + PRD updated. 4. Weekly Plan: Live Discussion Mode banner moved to top — users can start talking immediately. FR13 updated. 5. Weekly Plan: Required Materials checklist before apiary accordions (treatments, equipment, syrup). New FR13a. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add Dependabot with auto-merge via GitHub App (#3) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) * chore: enable CodeRabbit for AI-powered PR reviews Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add *.yml path instruction alongside *.yaml Addresses review feedback: the repo contains .yml files (e.g. dependabot-automerge.yml) that would miss YAML review guidance. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: correct SonarCloud workflow token handling (#10) Move SONAR_TOKEN to job-level env so the if-condition can reference it via env context. Secrets cannot be used directly in if: conditions. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Epic 1: Project Scaffolding & Monorepo Setup (Sprint 1) Implement all 4 stories for Epic 1, establishing the complete project foundation for Broodly: - Story 1-1: Monorepo with pnpm workspaces, Expo SDK 55, Go 1.24 API, 5 shared packages, Terraform structure - Story 1-2: GitHub Actions CI with TS (ESLint, tsc, Jest) and Go (vet, golangci-lint, test) jobs, Docker build, migration guard - Story 1-3: Gluestack UI v3 + NativeWind with all 9 Broodly color scales, 8px spacing, compound components, smoke tests - Story 1-4: Terraform modules for Cloud SQL (PostgreSQL 16 + pgvector), Cloud Storage, Pub/Sub (5 topics + DLQs), IAM, Secret Manager 29 tests passing (28 TS + 1 Go), 0 lint errors, 0 type errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...c10b8064de6f491fea524254123dbe5e09572f13) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/bee87b3258c251f9279e5371b0cc3660f37f3f77...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add dependabot update-and-merge workflow (#77) Add workflow to update behind Dependabot PRs and merge eligible ones. Add skip-commit-verification to automerge workflow for compatibility. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * feat: adopt org-wide feature-ideation reusable workflow (#84) Adds the BMAD Analyst (Mary) feature-research-and-ideation workflow as a thin caller stub for the org-wide reusable workflow at petry-projects/.github/.github/workflows/feature-ideation-reusable.yml. Runs every Friday at 07:00 UTC (manually dispatchable). Mary executes a 5-phase multi-skill pipeline (Market Research → Brainstorming → Party Mode → Adversarial → Publish) on Claude Opus 4.6 and posts evidence-grounded feature proposals to the Ideas discussion category. Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#8-feature-ideation-feature-ideationyml--bmad-method-repos Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897ec9aa9a0e84c0cc1b3ad29f0f6cf1748f7. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #112 — Compliance: secret_scan_ci_job_present (#219) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #180 — Compliance: check-suite-auto-trigger-1236702 (#216) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * feat: implement issue #243 — [Fleet Monitor] petry-projects/broodly — ci-failure-analyst.yml (#297) * fix(deps): pin shell-quote to >=1.8.4 to patch GHSA-w7jw-789q-3m8p Critical CVE in shell-quote <=1.8.3 allows newline injection via object .op values. Added pnpm override to force >=1.8.4 and regenerated pnpm-lock.yaml with the patched version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(deps): broaden dependency overrides to patch nested vulnerabilities Tightened pnpm dependency overrides from pattern-based constraints (e.g. tmp@<0.2.6) to unconditional versions (tmp, uuid) to ensure deeply nested vulnerable packages (e.g., tmp@0.0.33 via patch-package, js-yaml@3.14.2 via Babel/Jest) are properly patched. This resolves 5 pnpm audit violations (1 high, 3 moderate, 1 low) and regenerates pnpm-lock.yaml accordingly. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: sync org-standard pr-review-mention.yml stub from petry-projects/.github (#333) * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#359) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * feat: implement issue #377 — SonarCloud: JavaScript/TypeScript code quality (#379) * feat: implement issue #377 — SonarCloud: JavaScript/TypeScript code quality * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(heading): correct size type and forward children to MappedHeading Tighten createHeadingStyleProps to accept VariantProps<typeof headingStyle>['size'] instead of string | undefined so the object satisfies headingStyle()'s parameter type, resolving 7 TypeScript errors. Pass {children} explicitly when rendering MappedHeading; it was destructured in Heading but never forwarded, causing H1–H6 elements to render with no text content and breaking all Heading smoke tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml (#397) * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: fix pnpm v11 lockfile mismatch and add @types/jest [skip ci-relay] Move overrides authority from the now-ignored package.json pnpm.overrides field to pnpm-workspace.yaml (aligned with lockfile keys). Add @types/jest as an explicit devDependency to apps/mobile so TypeScript can resolve test globals under pnpm's strict node_modules isolation. Add "types": ["jest"] to apps/mobile/tsconfig.json. Regenerate lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove unused test scripts from workspace packages Packages config, domain-types, graphql-types, test-utils, and ui have test scripts that invoke jest but contain no test files and jest is not in their devDependencies. This causes test failure when pnpm run test is executed recursively. Remove the unused scripts since these packages are type/domain libraries with no unit test coverage. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #410 — Compliance: dev-lead-stub-pin (#412) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-require_last_push_approval * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#446) * chore: dev-lead update (review-changes) [skip ci-relay] * feat: implement issue #451 — SonarCloud: JavaScript/TypeScript code quality (#464) * feat: implement issue #451 — SonarCloud: JavaScript/TypeScript code quality * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: retrigger CI and dev-lead review Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Don Petry <don@petry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>

don-petry added 13 commits July 13, 2026 06:47

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

3edeef0

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

ae50baf

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

b0bee74

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

15fdf81

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

0a7a7eb

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

246506c

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

0329030

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

4bc5416

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

3fabcf3

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

17fb7cd

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

24d3f3f

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

66f5f24

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

c558648

don-petry added the standards-sync Org-standard workflow stub synced from petry-projects/.github label Jul 13, 2026

don-petry requested a review from a team as a code owner July 13, 2026 11:48

don-petry enabled auto-merge (squash) July 13, 2026 11:49

don-petry disabled auto-merge July 13, 2026 11:49

don-petry enabled auto-merge (squash) July 13, 2026 11:49

don-petry disabled auto-merge July 13, 2026 11:51

don-petry enabled auto-merge (squash) July 13, 2026 11:51

donpetry-bot approved these changes Jul 13, 2026

View reviewed changes

don-petry merged commit e1c1b45 into main Jul 13, 2026
26 checks passed

don-petry deleted the standards-sync/workflows-20260713 branch July 13, 2026 11:54

donpetry-bot approved these changes Jul 13, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github - #387

chore: sync 8 org-standard workflow stub(s) from petry-projects/.github#387
don-petry merged 13 commits into
mainfrom
standards-sync/workflows-20260713

don-petry commented Jul 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 13, 2026

Uh oh!

coderabbitai Bot commented Jul 13, 2026

Review limit reached

Uh oh!

gemini-code-assist Bot commented Jul 13, 2026

Uh oh!

don-petry commented Jul 13, 2026

Uh oh!

sonarqubecloud Bot commented Jul 13, 2026

Uh oh!

donpetry-bot commented Jul 13, 2026

Uh oh!

don-petry commented Jul 13, 2026

Uh oh!

donpetry-bot left a comment

Uh oh!

Uh oh!

donpetry-bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

don-petry commented Jul 13, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 13, 2026

Uh oh!

coderabbitai Bot commented Jul 13, 2026

Review limit reached

Uh oh!

gemini-code-assist Bot commented Jul 13, 2026

Uh oh!

don-petry commented Jul 13, 2026

Dev-Lead — review-changes (no-changes)

Uh oh!

sonarqubecloud Bot commented Jul 13, 2026

Quality Gate passed

Uh oh!

donpetry-bot commented Jul 13, 2026

Uh oh!

don-petry commented Jul 13, 2026

Dev-Lead — fix-bot-comment (no-changes)

Uh oh!

donpetry-bot left a comment

Choose a reason for hiding this comment

Automated review — APPROVED ✓

Summary

Linked issue analysis

Findings

CI status

Uh oh!

Uh oh!

donpetry-bot left a comment

Choose a reason for hiding this comment

Automated review — APPROVED ✓

Summary

Linked issue analysis

Findings

CI status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants