Repository navigation
chore(workflows): adopt centralized stubs from petry-projects/.github - #93
Merged
Merged
Conversation
Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 13 minutes and 35 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
There was a problem hiding this comment.
Pull request overview
This PR updates this repo’s GitHub Actions workflows to be “thin caller stubs” that delegate to the organization’s centralized reusable workflows in petry-projects/.github (pinned at @v1), reducing workflow drift and making future updates propagate automatically.
Changes:
- Replace inline workflow implementations with
uses: petry-projects/.github/.github/workflows/*-reusable.yml@v1caller stubs. - Standardize workflow headers/instructions and align callers with the org-level workflow standards.
- Simplify workflow logic in-repo (dependency audit + Dependabot automation now fully delegated).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/feature-ideation.yml | Converts to thin caller stub for org reusable; updates inputs and adds repo-specific project_context hook. |
| .github/workflows/dependency-audit.yml | Replaces in-repo ecosystem detection/audit jobs with a single reusable-workflow call. |
| .github/workflows/dependabot-rebase.yml | Delegates Dependabot “update and merge” serialization to org reusable workflow. |
| .github/workflows/dependabot-automerge.yml | Delegates Dependabot auto-approve/auto-merge logic to org reusable workflow. |
| .github/workflows/claude.yml | Pins Claude Code workflow to org reusable at @v1 and documents required secrets. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+85
to
+87
| TODO: Replace this with a description of the project and its market. | ||
| Example: "ProjectX is a [type of product] for [target user]. Competitors | ||
| include A, B, C. Key emerging trends in this space: X, Y, Z." |
There was a problem hiding this comment.
project_context is currently a TODO/example placeholder. As-is, the scheduled ideation run will generate generic/incorrect proposals for this repository. Replace this placeholder with this repo’s actual project context (you can likely restore the previous Broodly description) so the reusable workflow has meaningful input.
Suggested change
| TODO: Replace this with a description of the project and its market. | |
| Example: "ProjectX is a [type of product] for [target user]. Competitors | |
| include A, B, C. Key emerging trends in this space: X, Y, Z." | |
| Broodly is a product and engineering platform focused on helping teams design, build, and ship modern web applications with strong automation, maintainability, and developer experience. | |
| Its primary users are founders, product teams, and software engineers who want to move quickly without sacrificing quality, documentation, or delivery discipline. | |
| Research should consider competitors and adjacent solutions such as GitHub-native engineering workflows, AI-assisted developer tooling, low-code/internal platform tools, and modern SaaS product-building frameworks. | |
| Mary should look for opportunities around AI-enabled product ideation, planning, implementation workflows, collaboration, and repository-driven automation that would make Broodly more differentiated and useful. |
Comment on lines
16
to
+33
| @@ -20,199 +29,5 @@ permissions: | |||
| contents: read | |||
|
|
|||
| jobs: | |||
| detect: | |||
| name: Detect ecosystems | |||
| runs-on: ubuntu-latest | |||
| outputs: | |||
| npm: ${{ steps.check.outputs.npm }} | |||
| pnpm: ${{ steps.check.outputs.pnpm }} | |||
| gomod: ${{ steps.check.outputs.gomod }} | |||
| cargo: ${{ steps.check.outputs.cargo }} | |||
| pip: ${{ steps.check.outputs.pip }} | |||
| steps: | |||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |||
|
|
|||
| - name: Detect package ecosystems | |||
| id: check | |||
| run: | | |||
| # npm — look for package-lock.json anywhere (excluding node_modules) | |||
| if find . -name 'package-lock.json' -not -path '*/node_modules/*' | grep -q .; then | |||
| echo "npm=true" >> "$GITHUB_OUTPUT" | |||
| else | |||
| echo "npm=false" >> "$GITHUB_OUTPUT" | |||
| fi | |||
|
|
|||
| # pnpm — look for pnpm-lock.yaml anywhere | |||
| if find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' | grep -q .; then | |||
| echo "pnpm=true" >> "$GITHUB_OUTPUT" | |||
| else | |||
| echo "pnpm=false" >> "$GITHUB_OUTPUT" | |||
| fi | |||
|
|
|||
| # Go modules — detect via go.mod (not go.sum, which may not exist) | |||
| if find . -name 'go.mod' -not -path '*/vendor/*' | grep -q .; then | |||
| echo "gomod=true" >> "$GITHUB_OUTPUT" | |||
| else | |||
| echo "gomod=false" >> "$GITHUB_OUTPUT" | |||
| fi | |||
|
|
|||
| # Cargo — detect via Cargo.toml anywhere (lockfile may not exist for libraries) | |||
| if find . -name 'Cargo.toml' -not -path '*/target/*' | grep -q .; then | |||
| echo "cargo=true" >> "$GITHUB_OUTPUT" | |||
| else | |||
| echo "cargo=false" >> "$GITHUB_OUTPUT" | |||
| fi | |||
|
|
|||
| # Python — detect pyproject.toml or requirements.txt anywhere | |||
| if find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q . || \ | |||
| find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q .; then | |||
| echo "pip=true" >> "$GITHUB_OUTPUT" | |||
| else | |||
| echo "pip=false" >> "$GITHUB_OUTPUT" | |||
| fi | |||
|
|
|||
| audit-npm: | |||
| name: npm audit | |||
| needs: detect | |||
| if: needs.detect.outputs.npm == 'true' | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |||
|
|
|||
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |||
| with: | |||
| node-version: "lts/*" | |||
|
|
|||
| - name: Audit npm dependencies | |||
| run: | | |||
| # Audit each package-lock.json found in the repo | |||
| status=0 | |||
| while IFS= read -r dir; do | |||
| echo "::group::npm audit $dir" | |||
| if ! (cd "$dir" && npm audit --audit-level=low); then | |||
| status=1 | |||
| fi | |||
| echo "::endgroup::" | |||
| done < <(find . -name 'package-lock.json' -not -path '*/node_modules/*' -exec dirname {} \;) | |||
| exit $status | |||
|
|
|||
| audit-pnpm: | |||
| name: pnpm audit | |||
| needs: detect | |||
| if: needs.detect.outputs.pnpm == 'true' | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |||
|
|
|||
| - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4 | |||
|
|
|||
| - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0 | |||
| with: | |||
| node-version: "lts/*" | |||
|
|
|||
| - name: Audit pnpm dependencies | |||
| run: | | |||
| # Audit each pnpm-lock.yaml found in the repo | |||
| status=0 | |||
| while IFS= read -r dir; do | |||
| echo "::group::pnpm audit $dir" | |||
| if ! (cd "$dir" && pnpm audit --audit-level low); then | |||
| status=1 | |||
| fi | |||
| echo "::endgroup::" | |||
| done < <(find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' -exec dirname {} \;) | |||
| exit $status | |||
|
|
|||
| audit-go: | |||
| name: govulncheck | |||
| needs: detect | |||
| if: needs.detect.outputs.gomod == 'true' | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |||
|
|
|||
| - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5 | |||
| with: | |||
| go-version: "stable" | |||
|
|
|||
| - name: Install govulncheck | |||
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 | |||
|
|
|||
| - name: Audit Go dependencies | |||
| run: | | |||
| status=0 | |||
| while IFS= read -r dir; do | |||
| echo "::group::govulncheck $dir" | |||
| if ! (cd "$dir" && govulncheck ./...); then | |||
| status=1 | |||
| fi | |||
| echo "::endgroup::" | |||
| done < <(find . -name 'go.mod' -not -path '*/vendor/*' -exec dirname {} \;) | |||
| exit $status | |||
|
|
|||
| audit-cargo: | |||
| name: cargo audit | |||
| needs: detect | |||
| if: needs.detect.outputs.cargo == 'true' | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |||
|
|
|||
| - name: Install Rust stable toolchain | |||
| run: rustup toolchain install stable --profile minimal | |||
|
|
|||
| - name: Install cargo-audit | |||
| run: cargo install cargo-audit@0.22.1 --locked | |||
|
|
|||
| - name: Audit Cargo dependencies | |||
| run: | | |||
| # cargo audit operates on Cargo.lock at workspace root | |||
| # For workspaces, a single audit at root covers all crates | |||
| status=0 | |||
| while IFS= read -r dir; do | |||
| echo "::group::cargo audit $dir" | |||
| if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null; cargo audit); then | |||
| status=1 | |||
| fi | |||
| echo "::endgroup::" | |||
| done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u) | |||
| exit $status | |||
|
|
|||
| audit-pip: | |||
| name: pip-audit | |||
| needs: detect | |||
| if: needs.detect.outputs.pip == 'true' | |||
| runs-on: ubuntu-latest | |||
| steps: | |||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |||
|
|
|||
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |||
| with: | |||
| python-version: "3.x" | |||
|
|
|||
| - name: Install pip-audit | |||
| run: pip install pip-audit==2.9.0 | |||
|
|
|||
| - name: Audit Python dependencies | |||
| run: | | |||
| status=0 | |||
| # Audit each Python project found in the repo | |||
| while IFS= read -r dir; do | |||
| echo "::group::pip-audit $dir" | |||
| if [ -f "$dir/pyproject.toml" ]; then | |||
| if ! pip-audit "$dir"; then | |||
| status=1 | |||
| fi | |||
| elif [ -f "$dir/requirements.txt" ]; then | |||
| if ! pip-audit -r "$dir/requirements.txt"; then | |||
| status=1 | |||
| fi | |||
| fi | |||
| echo "::endgroup::" | |||
| done < <( | |||
| { | |||
| find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \; | |||
| find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \; | |||
| } | sort -u | |||
| ) | |||
| exit $status | |||
| dependency-audit: | |||
| uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1 | |||
There was a problem hiding this comment.
The header comment says to add the required status check dependency-audit / Detect ecosystems, but this thin-caller job doesn’t set name: Detect ecosystems (it will show as Dependency audit / dependency-audit). Either set the job name to match the documented required check (and any existing branch protection), or update the documentation to reflect the actual check name produced by this workflow.
| # Copy to .github/workflows/dependency-audit.yml | ||
| # ───────────────────────────────────────────────────────────────────────────── | ||
| # SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml | ||
| # Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym |
There was a problem hiding this comment.
The standards link anchor looks truncated: it ends with ...dependency-auditym (missing the trailing l), so the reference likely 404s. Update the anchor to the correct ...#5-dependency-audit-dependency-audityml.
Suggested change
| # Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym | |
| # Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-audityml |
This was referenced Apr 8, 2026
don-petry
added a commit
that referenced
this pull request
Jun 18, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Jun 19, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Jun 21, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
…uire_code_owner_review (#433) * Add BMAD method workspace and resume beekeeping brainstorming session * Add product brief for bmad-method outlining core vision, user journeys, and success metrics * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add zero-tap beeyard experience — core differentiator MAJOR: Broodly's key differentiator is now a zero-tap beeyard session. Once inspection starts, the user NEVER needs to tap the phone in the field. New FRs: - FR19c: Continuous multi-hive voice session (zero-tap, voice navigation) - FR19d: Per-hive context during multi-hive session (auto-save, TTS announce) - FR30c: Post-session Evening Review (tap-friendly at home) - FR19 updated: session-based not per-hive - FR27 updated: hive navigation commands (next/move to/which/how many/end) New stories: 8.8 (multi-hive voice session), 8.9 (evening review) Total: 64 stories across 12 epics Prototype: 30 screens (+3 new) - inspection-next-hive: voice transition between hives with context - inspection-session-end: session summary with stats - evening-review: tap-friendly per-hive correction UI - Homepage: "Review today's session" card added CLAUDE.md: Zero-Tap Beeyard section added as key differentiator UX spec: Continuous session + evening review patterns added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Goal slider, scale weights, card variants, voice-top plan, materials list 1. Goal Selection: replaced multi-select chips with Honey↔Splits sliding scale (competing priorities). Removed Learning/Growth. Colony health always prioritized. FR2b updated. 2. Homepage: added regional scale weight card (beecounted.org) showing daily weight trend for user's area. New FR10a, FR11c. 3. Design system: actionable cards (amber left border + chevron + hover) vs informational cards (no affordance). Applied across all prototype screens. CLAUDE.md + PRD updated. 4. Weekly Plan: Live Discussion Mode banner moved to top — users can start talking immediately. FR13 updated. 5. Weekly Plan: Required Materials checklist before apiary accordions (treatments, equipment, syrup). New FR13a. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add coding standards, Live Mode icon, notification types, and UX refinements Update CLAUDE.md with coding standards section (org standards + Broodly-specific guidelines for TypeScript, Go, and monorepo). Update PRD with FR12b2 (persistent Live Mode EQ icon), FR30c (photos/videos in Evening Review), FR40/FR40a2 (per-category notification toggles and types screen). Update UX spec with icon conventions, notification types screen, and Live Mode activation from app header. Add Live Mode icon exploration HTML files and test framework spec. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Add AGENTS.md with full project rules, slim down CLAUDE.md Follows the org convention where AGENTS.md is the comprehensive agent-agnostic file and CLAUDE.md is a Claude Code-specific summary with @import for org-wide standards. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@5c8a8a6...c10b806) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@34e1148...de0fac2) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@094bd24...88c168b) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@bee87b3...1eddb33) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@c10b806...95e58e9) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897e. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * fix: use explicit secrets and write permissions in dependabot-rebase workflow (#170) * fix: use explicit secrets and write permissions in dependabot-rebase workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs. * fix: pin reusable SHA, update header guidance, fix secrets comment Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets * fix: apply prettier formatting (single space before inline comments) * fix: apply prettier formatting to auto-rebase.yml (single space before inline comments) * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@95e58e9...e46ed2c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@e46ed2c...68bde55) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * feat: implement issue #243 — [Fleet Monitor] petry-projects/broodly — ci-failure-analyst.yml (#297) * fix(deps): pin shell-quote to >=1.8.4 to patch GHSA-w7jw-789q-3m8p Critical CVE in shell-quote <=1.8.3 allows newline injection via object .op values. Added pnpm override to force >=1.8.4 and regenerated pnpm-lock.yaml with the patched version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(deps): broaden dependency overrides to patch nested vulnerabilities Tightened pnpm dependency overrides from pattern-based constraints (e.g. tmp@<0.2.6) to unconditional versions (tmp, uuid) to ensure deeply nested vulnerable packages (e.g., tmp@0.0.33 via patch-package, js-yaml@3.14.2 via Babel/Jest) are properly patched. This resolves 5 pnpm audit violations (1 high, 3 moderate, 1 low) and regenerates pnpm-lock.yaml accordingly. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: sync org-standard pr-review-mention.yml stub from petry-projects/.github (#333) * chore: sync org-standard auto-rebase.yml stub from petry-projects/.github (#335) * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#359) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml (#397) * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: fix pnpm v11 lockfile mismatch and add @types/jest [skip ci-relay] Move overrides authority from the now-ignored package.json pnpm.overrides field to pnpm-workspace.yaml (aligned with lockfile keys). Add @types/jest as an explicit devDependency to apps/mobile so TypeScript can resolve test globals under pnpm's strict node_modules isolation. Add "types": ["jest"] to apps/mobile/tsconfig.json. Regenerate lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove unused test scripts from workspace packages Packages config, domain-types, graphql-types, test-utils, and ui have test scripts that invoke jest but contain no test files and jest is not in their devDependencies. This causes test failure when pnpm run test is executed recursively. Remove the unused scripts since these packages are type/domain libraries with no unit test coverage. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #410 — Compliance: dev-lead-stub-pin (#412) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#437) * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github (#440) * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * chore: sync 5 org-standard workflow stub(s) from petry-projects/.github * fix(reviews): address review comments [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(reviews): address review comments [skip ci-relay] --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Don Petry <don@petry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Aug 4, 2026
…#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry
added a commit
that referenced
this pull request
Aug 18, 2026
…uire_last_push_approval (#432) * Add BMAD method workspace and resume beekeeping brainstorming session * Update brainstorming session document with completed steps and new ideas generated * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...c10b8064de6f491fea524254123dbe5e09572f13) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/bee87b3258c251f9279e5371b0cc3660f37f3f77...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897ec9aa9a0e84c0cc1b3ad29f0f6cf1748f7. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * fix: use explicit secrets and write permissions in dependabot-rebase workflow (#170) * fix: use explicit secrets and write permissions in dependabot-rebase workflow secrets: inherit + permissions: read causes startup_failure on reusable workflows. Use explicit APP_ID/APP_PRIVATE_KEY secrets and write permissions so the reusable workflow can update branches and approve PRs. * fix: pin reusable SHA, update header guidance, fix secrets comment Address Copilot review comments: - Pin uses: to commit SHA instead of mutable @v1 tag - Update header: 'SHA' → 'ref', remove ban on workflow_dispatch trigger - Update header: '(inherited)' → '(passed explicitly)' for secrets * fix: apply prettier formatting (single space before inline comments) * fix: apply prettier formatting to auto-rebase.yml (single space before inline comments) * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#437) * Add BMAD method workspace and resume beekeeping brainstorming session * Remove _bmad-output (moved to separate PR) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Remove duplicate .github/skills content Skills already exist under .claude/skills. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add beekeeping mentor app planning artifacts (_bmad-output) Includes brainstorming session, market and domain research reports, product brief, PRD, architecture, implementation readiness report, and UX design directions and specification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Add MVP epics (12), stories (62), and sprint status tracking - 12 epics sequenced per architecture implementation order: scaffolding, auth, DB, GraphQL, mobile shell, onboarding, apiary/hive CRUD, guided inspection, recommendations, planning, voice/media pipeline, notifications - 62 stories with TDD requirements (tests-first for every story) - All 58 FRs mapped to implementation stories - Sprint status YAML for tracking (all items at backlog) - Estimated scope: 94-135 implementation days Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add all 62 stories (Epics 2-12) ready-for-dev with TDD requirements Complete implementation blueprint — all 12 epics, 62 stories: - Epic 2: Auth & Identity (5 stories) — Firebase, JWT, RBAC - Epic 3: Database Schema (5 stories) — PostgreSQL, migrations, sqlc - Epic 4: GraphQL Schema (5 stories) — gqlgen, recommendation contract - Epic 5: Mobile App Shell (5 stories) — Expo Router, Apollo, Zustand - Epic 6: Onboarding (5 stories) — Welcome through disclaimer - Epic 7: Apiary/Hive CRUD (6 stories) — Health cards, collaborators - Epic 8: Guided Inspection (7 stories) — Voice, photo, AI, summary - Epic 9: Recommendations (5 stories) — Context, Gemini, confidence - Epic 10: Planning (5 stories) — Homepage, weekly queue, calendar - Epic 11: Voice/Media Pipeline (5 stories) — Upload, STT, embeddings - Epic 12: Notifications (5 stories) — Dispatch, escalation, feedback Sprint status reconciled: all epics in-progress, all stories ready-for-dev. Every story includes TDD requirements (tests-first). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add zero-tap beeyard experience — core differentiator MAJOR: Broodly's key differentiator is now a zero-tap beeyard session. Once inspection starts, the user NEVER needs to tap the phone in the field. New FRs: - FR19c: Continuous multi-hive voice session (zero-tap, voice navigation) - FR19d: Per-hive context during multi-hive session (auto-save, TTS announce) - FR30c: Post-session Evening Review (tap-friendly at home) - FR19 updated: session-based not per-hive - FR27 updated: hive navigation commands (next/move to/which/how many/end) New stories: 8.8 (multi-hive voice session), 8.9 (evening review) Total: 64 stories across 12 epics Prototype: 30 screens (+3 new) - inspection-next-hive: voice transition between hives with context - inspection-session-end: session summary with stats - evening-review: tap-friendly per-hive correction UI - Homepage: "Review today's session" card added CLAUDE.md: Zero-Tap Beeyard section added as key differentiator UX spec: Continuous session + evening review patterns added Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Goal slider, scale weights, card variants, voice-top plan, materials list 1. Goal Selection: replaced multi-select chips with Honey↔Splits sliding scale (competing priorities). Removed Learning/Growth. Colony health always prioritized. FR2b updated. 2. Homepage: added regional scale weight card (beecounted.org) showing daily weight trend for user's area. New FR10a, FR11c. 3. Design system: actionable cards (amber left border + chevron + hover) vs informational cards (no affordance). Applied across all prototype screens. CLAUDE.md + PRD updated. 4. Weekly Plan: Live Discussion Mode banner moved to top — users can start talking immediately. FR13 updated. 5. Weekly Plan: Required Materials checklist before apiary accordions (treatments, equipment, syrup). New FR13a. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add Dependabot with auto-merge via GitHub App (#3) * chore: add Dependabot configuration * chore: add Dependabot auto-merge workflow * fix(ci): use pull_request_target for Dependabot secret access * fix: add project copyright notice to LICENSE (#7) * fix: add project copyright notice to LICENSE Add project-specific copyright notice for Don Petry at the top of the LICENSE file, before the AGPL-3.0 license text. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: revert LICENSE to verbatim AGPL-3.0 text Remove the copyright line from the LICENSE file as it makes the file non-verbatim, violating the FSF's "changing it is not allowed" clause. The project copyright is already properly declared in the NOTICE file. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Don Petry <don@petry.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: enable CodeRabbit for AI-powered PR reviews (#8) * chore: enable CodeRabbit for AI-powered PR reviews Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add *.yml path instruction alongside *.yaml Addresses review feedback: the repo contains .yml files (e.g. dependabot-automerge.yml) that would miss YAML review guidance. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: correct SonarCloud workflow token handling (#10) Move SONAR_TOKEN to job-level env so the if-condition can reference it via env context. Secrets cannot be used directly in if: conditions. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude Code GitHub Action (#13) * Add Claude Code GitHub Action for PR reviews * fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OpenSSF Scorecard findings - Add SECURITY.md (#16) - Scope workflow token permissions to least privilege (#17) - Pin all GitHub Action dependencies to commit SHAs (#18) - Add CodeQL SAST workflow for all commits (#19) - Broaden CI pull_request trigger to cover all branches (#20) Closes #16, #17, #18, #19, #20 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use 'actions' language for CodeQL since repo has no JS/TS source The repo contains HTML and Groovy, not JavaScript. CodeQL supports analyzing GitHub Actions workflows via the 'actions' language. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address PR review comments - Replace permissions: read-all with permissions: {} (deny-by-default) - Reduce dependabot-automerge job token to read-only (app token handles writes) - Add actions: read to CodeQL job permissions - Add concrete security contact email and version target to SECURITY.md Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: use claude_code_oauth_token instead of anthropic_api_key The action has separate inputs for API keys vs OAuth tokens. CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key. * Epic 1: Project Scaffolding & Monorepo Setup (Sprint 1) Implement all 4 stories for Epic 1, establishing the complete project foundation for Broodly: - Story 1-1: Monorepo with pnpm workspaces, Expo SDK 55, Go 1.24 API, 5 shared packages, Terraform structure - Story 1-2: GitHub Actions CI with TS (ESLint, tsc, Jest) and Go (vet, golangci-lint, test) jobs, Docker build, migration guard - Story 1-3: Gluestack UI v3 + NativeWind with all 9 Broodly color scales, 8px spacing, compound components, smoke tests - Story 1-4: Terraform modules for Cloud SQL (PostgreSQL 16 + pgvector), Cloud Storage, Pub/Sub (5 topics + DLQs), IAM, Secret Manager 29 tests passing (28 TS + 1 Go), 0 lint errors, 0 type errors. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump github/codeql-action from 3.35.1 to 4.35.1 (#47) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...c10b8064de6f491fea524254123dbe5e09572f13) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/checkout from 4.3.1 to 6.0.2 (#40) Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * ci: skip Claude Code reviewer on Dependabot PRs (#50) * ci: skip Claude Code reviewer on Dependabot PRs The claude workflow fails on Dependabot PRs because secrets (CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor. This blocks the dependabot auto-merge automation when claude is a required status check. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: use PR author login instead of github.actor for Dependabot check github.actor reflects who triggered the workflow run (e.g. a maintainer reopening), not the PR author. Use github.event.pull_request.user.login for reliable Dependabot detection, consistent with dependabot-automerge.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: move Dependabot exclusion to step-level in Claude workflow (#52) * ci: move Dependabot exclusion to step-level in Claude workflow Move the dependabot[bot] check from job-level `if` to step-level `if` so the claude job runs and reports SUCCESS (with a skipped step) instead of being skipped entirely. A skipped job doesn't satisfy required status checks in branch protection, but a successful job with a skipped step does. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * ci: guard step-level Dependabot check for pull_request events only The step-level if needs to handle issue_comment and pull_request_review_comment events where github.event.pull_request is not present. Use event_name guard to avoid null dereference. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#39) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.82 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump anthropics/claude-code-action from 1.0.83 to 1.0.88 (#55) Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.83 to 1.0.88. - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](https://github.com/anthropics/claude-code-action/compare/bee87b3258c251f9279e5371b0cc3660f37f3f77...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47) --- updated-dependencies: - dependency-name: anthropics/claude-code-action dependency-version: 1.0.88 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore: enable Claude issue trigger per org CI standard (#69) * chore: enable Claude issue trigger per org CI standard Add issues:[labeled] event trigger and claude label support so Claude can work issues like a human contributor — reading the issue, creating a branch, implementing the fix, and opening a PR. Changes: - Add issues:[labeled] trigger to on: block - Add issue label condition to job if: guard - Upgrade contents permission to write (needed for branch creation) - Pin claude-code-action to v1.0.89 (6e2bd528) - Add label_trigger: "claude" input Matches the standard configuration defined in petry-projects/.github#24 (standards/ci-standards.md § Claude Code). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore: add permission comment per CodeRabbit review Document why contents: write is needed (issue-triggered branch creation). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add checkout step to Claude workflow for issue-triggered mode (#70) The claude-code-action runs git fetch/checkout internally during branch setup but requires the repository to already be cloned on the runner. Without actions/checkout, issue-triggered runs fail with: fatal: not a git repository Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add dependabot update-and-merge workflow (#77) Add workflow to update behind Dependabot PRs and merge eligible ones. Add skip-commit-verification to automerge workflow for compatibility. Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: split Claude workflow into interactive + issue automation jobs (#79) * feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard for Claude Code workflows. The single monolithic job is now two: - `claude` — interactive PR reviews and @claude mentions - `claude-issue` — issue-labeled automation that implements, opens a PR, self-reviews, checks CI, and notifies code owners Adds `actions: read` and `checks: read` permissions plus explicit allowed-tools and prompt for the issue automation job. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: switch to org-level reusable Claude Code workflow (#80) * chore: add CODEOWNERS file for code owner review enforcement Adds .github/CODEOWNERS assigning @don-petry as the default code owner for all repository paths, resolving the missing-codeowners compliance finding. Closes #68 Co-authored-by: don-petry <don-petry@users.noreply.github.com> * feat: adopt org-wide feature-ideation reusable workflow (#84) Adds the BMAD Analyst (Mary) feature-research-and-ideation workflow as a thin caller stub for the org-wide reusable workflow at petry-projects/.github/.github/workflows/feature-ideation-reusable.yml. Runs every Friday at 07:00 UTC (manually dispatchable). Mary executes a 5-phase multi-skill pipeline (Market Research → Brainstorming → Party Mode → Adversarial → Publish) on Claude Opus 4.6 and posts evidence-grounded feature proposals to the Ideas discussion category. Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#8-feature-ideation-feature-ideationyml--bmad-method-repos Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(workflows): adopt centralized stubs from petry-projects/.github (#93) Replace inline copies of standardized workflows with the canonical thin caller stubs from petry-projects/.github/standards/workflows/. Each stub delegates to a versioned reusable workflow at petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so future updates to the standard propagate automatically and drift is caught by the org-wide compliance audit. See petry-projects/.github#87, #88, #89 for context. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.1 to 4.35.2 (#156) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.1 to 4.35.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: correct reusable workflow path (remove duplicate .github/) (#162) fix: correct reusable workflow path (remove duplicate .github/ segment) Changed: petry-projects/.github/.github/workflows/... To: petry-projects/.github/workflows/... Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * Revert "fix: correct reusable workflow path (remove duplicate .github/) (#162)" This reverts commit 7d2897ec9aa9a0e84c0cc1b3ad29f0f6cf1748f7. * ci: add auto-rebase workflow and check_run trigger to claude.yml * add check_run trigger to claude.yml * add auto-rebase.yml workflow * chore: add bot accounts to CODEOWNERS for auto-merge support * chore: standardize CODEOWNERS on @petry-projects/org-leads (#172) Per the org-wide standard defined in petry-projects/.github (standards/codeowners-standard.md), replace individual user/bot listings with the @petry-projects/org-leads team. Closes the CODEOWNERS gap from pr-review-agent#27. Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#174) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#190) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.35.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: remove drift codeql.yml, enable GitHub-managed default setup (#126) ci: remove drift codeql.yml and enable GitHub-managed default setup Per org standard §2, CodeQL must use GitHub-managed default setup (Settings → Code security → Code scanning), not a per-repo workflow file. The existing codeql.yml was identified as drift by the compliance audit (issue #109). CodeQL default setup has been configured via the GitHub API: gh api -X PATCH repos/petry-projects/broodly/code-scanning/default-setup \ -F state=configured -F query_suite=default This removes the drift file and brings the repo into compliance with the codeql-default-setup-not-configured finding. Closes #109 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> * chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#195) * fix: add *.pem to .gitignore for push-protection compliance (#141) Adds `*.pem` to .gitignore alongside existing key/cert patterns (`*.jks`, `*.p8`, `*.p12`, `*.key`) to satisfy the gitignore_secrets_block compliance check from the org push-protection standard. Closes #113 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * feat: implement issue #193 — Compliance: unpinned-actions-dev-lead.yml (#208) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #189 — Compliance: dependabot_security_updates (#210) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #178 — Compliance: codeowners-no-catchall (#209) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #188 — Compliance: secret_scanning_non_provider_patterns (#212) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #103 — Compliance: unpinned-actions-dependency-audit.yml (#221) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #112 — Compliance: secret_scan_ci_job_present (#219) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #180 — Compliance: check-suite-auto-trigger-1236702 (#216) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#215) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #181 — Compliance: check-suite-auto-trigger-347564 (#231) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #100 — Compliance: unpinned-actions-claude.yml (#236) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * rollout: deploy pr-review-mention standard workflow (#282) * rollout: deploy pr-review-mention standard workflow * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * deploy: add pr-review.yml workflow * feat: implement issue #287 — [Fleet Monitor] petry-projects/broodly — sonarcloud.yml (#288) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main (#290) * feat: implement issue #72 — fix: broodly CI 'Push API Image' job failing on main * fix(reviews): address review comments [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first (#305) * feat: implement issue #177 — Compliance: codeowners-org-leads-not-first * chore: apply manual instructions [skip ci-relay] * fix: remove duplicate shell-quote override from pnpm-lock.yaml The pnpm-lock.yaml contained both 'shell-quote' and 'shell-quote@<1.8.4' overrides, but package.json only specified the versioned variant. This mismatch caused pnpm install --frozen-lockfile to fail with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH. Removed the duplicate unversioned entry. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * feat: implement issue #243 — [Fleet Monitor] petry-projects/broodly — ci-failure-analyst.yml (#297) * fix(deps): pin shell-quote to >=1.8.4 to patch GHSA-w7jw-789q-3m8p Critical CVE in shell-quote <=1.8.3 allows newline injection via object .op values. Added pnpm override to force >=1.8.4 and regenerated pnpm-lock.yaml with the patched version. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(deps): broaden dependency overrides to patch nested vulnerabilities Tightened pnpm dependency overrides from pattern-based constraints (e.g. tmp@<0.2.6) to unconditional versions (tmp, uuid) to ensure deeply nested vulnerable packages (e.g., tmp@0.0.33 via patch-package, js-yaml@3.14.2 via Babel/Jest) are properly patched. This resolves 5 pnpm audit violations (1 high, 3 moderate, 1 low) and regenerates pnpm-lock.yaml accordingly. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * chore: sync org-standard pr-review-mention.yml stub from petry-projects/.github (#333) * ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#359) * ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-auto-review.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549) * ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549) * feat: implement issue #377 — SonarCloud: JavaScript/TypeScript code quality (#379) * feat: implement issue #377 — SonarCloud: JavaScript/TypeScript code quality * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] * fix(heading): correct size type and forward children to MappedHeading Tighten createHeadingStyleProps to accept VariantProps<typeof headingStyle>['size'] instead of string | undefined so the object satisfies headingStyle()'s parameter type, resolving 7 TypeScript errors. Pass {children} explicitly when rendering MappedHeading; it was destructured in Heading but never forwarded, causing H1–H6 elements to render with no text content and breaking all Heading smoke tests. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com> * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#387) * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * chore: sync 8 org-standard workflow stub(s) from petry-projects/.github * fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#391) fix: re-pin agent_ref to v-form for add-to-project.yml [#657] * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml (#397) * feat: implement issue #368 — Compliance: non-stub-feature-ideation.yml * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: fix pnpm v11 lockfile mismatch and add @types/jest [skip ci-relay] Move overrides authority from the now-ignored package.json pnpm.overrides field to pnpm-workspace.yaml (aligned with lockfile keys). Add @types/jest as an explicit devDependency to apps/mobile so TypeScript can resolve test globals under pnpm's strict node_modules isolation. Add "types": ["jest"] to apps/mobile/tsconfig.json. Regenerate lockfile. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: remove unused test scripts from workspace packages Packages config, domain-types, graphql-types, test-utils, and ui have test scripts that invoke jest but contain no test files and jest is not in their devDependencies. This causes test failure when pnpm run test is executed recursively. Remove the unused scripts since these packages are type/domain libraries with no unit test coverage. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: implement issue #410 — Compliance: dev-lead-stub-pin (#412) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #411 — Compliance: dev-lead-stub-agent-ref (#413) Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: insert org secrets baseline in .gitignore (#420) * chore: insert org secrets baseline in .gitignore * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * feat: implement issue #409 — Compliance: ruleset-drift-pr-quality-require_last_push_approval * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#446) * chore: dev-lead update (review-changes) [skip ci-relay] * feat: implement issue #451 — SonarCloud: JavaScript/TypeScript code quality (#464) * feat: implement issue #451 — SonarCloud: JavaScript/TypeScript code quality * chore: dev-lead update (review-changes) [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: dev-lead update (review-changes) [skip ci-relay] * chore: retrigger CI and dev-lead review Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Don Petry <don@petry.com> Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com> Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Replaces inline copies of standardized workflows with the canonical thin caller stubs from
petry-projects/.github/standards/workflows/. Each stub delegates to the org-level reusable workflow atpetry-projects/.github/.github/workflows/<name>-reusable.yml@v1.Why
Future updates to the standard propagate automatically without per-repo PRs, and drift is caught by the org-wide compliance audit (petry-projects/.github#89).
See petry-projects/.github#87 (build reusables), petry-projects/.github#88 (pin to v1, document tier model), petry-projects/.github#89 (audit drift detection).
Test plan
actionlintclean🤖 Generated with Claude Code