Skip to content

Add Claude Code GitHub Action - #12

Merged
don-petry merged 5 commits into
mainfrom
add-claude-code-action
Mar 27, 2026
Merged

don-petry merged 5 commits into
mainfrom
add-claude-code-action

Conversation

@don-petry

@don-petry don-petry commented Mar 27, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • Adds Claude Code GitHub Action workflow for automated PR reviews
  • Triggers on PR open/sync and when @claude is mentioned in comments
  • Requires ANTHROPIC_API_KEY secret to be configured in repo settings

Setup Required

  1. Add ANTHROPIC_API_KEY as a repository secret (Settings → Secrets and variables → Actions)

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Chores
    • Added an automated AI-assisted code review workflow that runs on pull requests and can be triggered via specific review comments to provide review assistance and annotations.

Copilot AI review requested due to automatic review settings March 27, 2026 03:32
@coderabbitai

coderabbitai Bot commented Mar 27, 2026 •

Copy link
Copy Markdown

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 2 minutes and 31 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 2 minutes and 31 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: e77cce88-64d2-4824-b53f-6e547248f2d5

📥 Commits

Reviewing files that changed from the base of the PR and between a9fb429 and 838729c.

📒 Files selected for processing (1)
  • .github/workflows/claude.yml
📝 Walkthrough

Walkthrough

Adds a new GitHub Actions workflow .github/workflows/claude.yml that runs the anthropics/claude-code-action@v1 on pull request events and on comment/review-comment events when @claude is mentioned by authorized contributors.

Changes

Cohort / File(s) Summary
GitHub Actions Workflow
.github/workflows/claude.yml
New workflow "Claude Code" triggers on pull_request (opened, reopened, synchronize), issue_comment, and pull_request_review_comment. Job runs on ubuntu-latest with 60-minute timeout, minimal repo permissions and id-token: write. For comment events, executes only when comment body contains @claude and commenter author_association is OWNER, MEMBER, or COLLABORATOR. Runs anthropics/claude-code-action@v1 using secrets.CLAUDE_CODE_OAUTH_TOKEN as the Anthropic API key.

Sequence Diagram(s)

sequenceDiagram
  participant User as User (commenter / PR author)
  participant GitHub as GitHub Events
  participant Runner as Actions Runner
  participant Claude as Anthropic Claude API

  User->>GitHub: open PR / post comment (may include `@claude`)
  GitHub->>Runner: trigger workflow (conditional evaluated)
  alt condition matched
    Runner->>Runner: set permissions, timeout, env (secrets)
    Runner->>Claude: run anthropics/claude-code-action (with API key)
    Claude-->>Runner: analysis/result
    Runner->>GitHub: post review/comment on PR
  else condition not matched
    GitHub-->>Runner: workflow job skipped
  end
Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'Add Claude Code GitHub Action' accurately and concisely describes the main change—adding a new GitHub Actions workflow file for Claude Code integration.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch add-claude-code-action

Comment @coderabbitai help to get the list of available commands and usage tips.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new GitHub Actions workflow to run the Claude Code action for automated pull request reviews, triggered on PR activity and on-demand via @claude comments.

Changes:

  • Introduces a Claude Code workflow triggered on pull_request (opened/reopened/synchronize).
  • Adds an issue_comment trigger to run when a comment contains @claude.
  • Configures the workflow to pass secrets.ANTHROPIC_API_KEY into anthropics/claude-code-action@v1.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/claude.yml Outdated
Comment thread .github/workflows/claude.yml Outdated
Comment thread .github/workflows/claude.yml
- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
.github/workflows/claude.yml (1)

11-22: Consider adding concurrency to avoid duplicate in-flight reviews.

Line 11–Line 22 can queue multiple runs during rapid synchronize events. A concurrency group with cancel-in-progress: true will reduce cost/noise.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/claude.yml around lines 11 - 22, Add a concurrency group
to the claude job to prevent duplicate in-flight runs: under jobs.claude (near
runs-on) add a concurrency block that defines a stable group identifier (e.g.,
using github.workflow and either github.event.pull_request.number or
github.ref/sha) and set cancel-in-progress: true so new runs cancel previous
ones for the same PR/branch.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/claude.yml:
- Line 29: Replace the mutable action ref "anthropics/claude-code-action@v1"
with a pinned commit SHA (e.g., "anthropics/claude-code-action@<commit-sha>") to
prevent automatic updates; locate the uses: anthropics/claude-code-action@v1
line in the workflow and update the tag to the desired immutable commit SHA (or
a full ref like refs/heads/<branch>@<sha>) and commit the change.

---

Nitpick comments:
In @.github/workflows/claude.yml:
- Around line 11-22: Add a concurrency group to the claude job to prevent
duplicate in-flight runs: under jobs.claude (near runs-on) add a concurrency
block that defines a stable group identifier (e.g., using github.workflow and
either github.event.pull_request.number or github.ref/sha) and set
cancel-in-progress: true so new runs cancel previous ones for the same
PR/branch.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ebb4345b-380e-498f-bd97-c3620d0efa38

📥 Commits

Reviewing files that changed from the base of the PR and between 60dae65 and e89b059.

📒 Files selected for processing (1)
  • .github/workflows/claude.yml

Comment thread .github/workflows/claude.yml Outdated
DJ and others added 3 commits March 27, 2026 06:19
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sonarqubecloud

Copy link
Copy Markdown

@don-petry
don-petry merged commit 72d45b3 into main Mar 27, 2026
13 checks passed
@don-petry
don-petry deleted the add-claude-code-action branch March 27, 2026 13:37
don-petry added a commit that referenced this pull request Jun 1, 2026
* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry added a commit that referenced this pull request Jun 19, 2026
* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry added a commit that referenced this pull request Aug 4, 2026
* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry added a commit that referenced this pull request Aug 7, 2026
#351)

* Initial commit

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add planning artifacts, UX screen prototypes, and Claude config (#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>

* feat: add Epic 1 sprint planning, coding standards, and test strategy (#22)

- Generate sprint-status.yaml tracking all 8 epics and 43 stories
- Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD)
  adapted for Go + React Native/Expo stack with bounded contexts,
  aggregate roots, typed IDs, repository interfaces, domain events,
  and dependency direction rules
- Define Epic 1 test strategy with 50+ test cases covering auth,
  role selection, manager permissions, and RBAC middleware
- Reference org-level AGENTS.md to eliminate principle duplication
- Update Agents.md and CLAUDE.md to reference org standards

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...88c168b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...1eddb33)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in combsmith/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See combsmith/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see combsmith/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from #78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5c8a8a6...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: combsmith/.github#154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8c.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...e46ed2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e46ed2c...68bde55)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...9e0d7b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry added a commit that referenced this pull request Aug 7, 2026
* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry added a commit that referenced this pull request Aug 7, 2026
…uire_last_push_approval (#355)

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...88c168b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...1eddb33)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in combsmith/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See combsmith/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see combsmith/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from #78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5c8a8a6...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: combsmith/.github#154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8c.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...e46ed2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e46ed2c...68bde55)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...9e0d7b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316)

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

* chore: dev-lead update (review-changes) [skip ci-relay]

* chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry added a commit that referenced this pull request Aug 14, 2026
* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
don-petry added a commit that referenced this pull request Aug 14, 2026
#351)

* Initial commit

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add planning artifacts, UX screen prototypes, and Claude config (#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>

* feat: add Epic 1 sprint planning, coding standards, and test strategy (#22)

- Generate sprint-status.yaml tracking all 8 epics and 43 stories
- Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD)
  adapted for Go + React Native/Expo stack with bounded contexts,
  aggregate roots, typed IDs, repository interfaces, domain events,
  and dependency direction rules
- Define Epic 1 test strategy with 50+ test cases covering auth,
  role selection, manager permissions, and RBAC middleware
- Reference org-level AGENTS.md to eliminate principle duplication
- Update Agents.md and CLAUDE.md to reference org standards

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...88c168b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...1eddb33)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in combsmith/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See combsmith/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see combsmith/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from #78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5c8a8a6...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: combsmith/.github#154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8c.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...e46ed2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e46ed2c...68bde55)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...9e0d7b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry added a commit that referenced this pull request Aug 14, 2026
…uire_last_push_approval (#355)

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...88c168b)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](anthropics/claude-code-action@094bd24...1eddb33)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in combsmith/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See combsmith/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see combsmith/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from #78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@5c8a8a6...95e58e9)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: combsmith/.github#154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8c.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@95e58e9...e46ed2c)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@e46ed2c...68bde55)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@68bde55...9e0d7b8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316)

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval

* chore: dev-lead update (review-changes) [skip ci-relay]

* chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
don-petry added a commit that referenced this pull request Aug 14, 2026
…de-quality (#408)

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See petry-projects/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see petry-projects/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from petry-projects/markets#78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: https://github.com/petry-projects/.github/pull/154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* ci: inline NOSONAR(S7637) markers on first-party caller stubs (#549 canonical migration) (#300)

* ci: inline NOSONAR(S7637) marker on add-to-project.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on agent-shield.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on auto-rebase.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dependabot-automerge.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dependabot-rebase.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dependency-audit.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on dev-lead.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on pr-review-mention.yml channel ref (#549)

* ci: inline NOSONAR(S7637) marker on pr-review.yml channel ref (#549)

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github (#316)

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 8 org-standard workflow stub(s) from petry-projects/.github

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks (#334)

* feat: implement issue #326 — Compliance: ruleset-drift-code-quality-required_status_checks

* fix(bot): address bot feedback [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref (#356)

* feat: implement issue #328 — Compliance: dev-lead-stub-agent-ref

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: Don Petry Bot <donpetry+bot@gmail.com>

* chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#364)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github (#369)

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* chore: sync 2 org-standard workflow stub(s) from petry-projects/.github

* feat: implement issue #329 — Compliance: stub-surface-drift-feature-ideation.yml-on (#357)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #384 — SonarCloud: miscellaneous findings (#393)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review (#352)

* feat: implement issue #323 — Compliance: ruleset-drift-pr-quality-require_code_owner_review

* chore: dev-lead update (review-changes) [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* chore: sync 1 org-standard workflow stub(s) from petry-projects/.github (#380)

* feat: implement issue #327 — Compliance: dev-lead-stub-pin (#354)

* feat: implement issue #327 — Compliance: dev-lead-stub-pin

* fix(bot): address bot feedback [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml (#351)

* Initial commit

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: add planning artifacts, UX screen prototypes, and Claude config (#6)

* chore: add planning artifacts, UX screens, and Claude config

Add BMAD planning output including architecture, epics, UX design
specification, and UX screen prototypes. Also adds Claude Code
memory and settings configuration.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update user role description in MEMORY.md

* chore: gitignore machine-specific Claude memory and remove from repo

These files are per-machine Claude Code project memory that shouldn't
be shared in the repository.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback on UX prototypes and specs

- Comment out remote figma capture.js script tags (security/hermetic)
- Fix invalid viewport initial-scale=375 to initial-scale=1
- Fix Riverside market hours inconsistency (8AM-5PM → 8AM-1PM)
- Replace absolute filesystem paths with repo-relative paths in UX spec
- Change filter chips from horizontal scroll to flex-wrap per design rules

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: update UX screen prototypes and add test artifacts

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback — comment out Figma capture scripts and add code block language specifier

- Comment out remote Figma capture.js in 12 HTML prototypes for security/hermeticity
- Add `text` language specifier to CLAUDE.md directory tree code block

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* refactor: split CLAUDE.md into Agents.md (shared standards) and Claude-specific instructions

- Move project coding standards to Agents.md for use by any AI agent or developer
- Keep Figma MCP workflow and asset handling rules in CLAUDE.md
- CLAUDE.md now references Agents.md at the top

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>

* feat: add Epic 1 sprint planning, coding standards, and test strategy (#22)

- Generate sprint-status.yaml tracking all 8 epics and 43 stories
- Define comprehensive coding standards (TDD, SOLID, DRY, CLEAN, DDD)
  adapted for Go + React Native/Expo stack with bounded contexts,
  aggregate roots, typed IDs, repository interfaces, domain events,
  and dependency direction rules
- Define Epic 1 test strategy with 50+ test cases covering auth,
  role selection, manager permissions, and RBAC middleware
- Reference org-level AGENTS.md to eliminate principle duplication
- Update Agents.md and CLAUDE.md to reference org standards

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to the standard propagate automatically and drift is
caught by the org-wide compliance audit.

See petry-projects/.github#87, #88, #89 for context.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): drop claude.yml from sweep — handled separately

claude-code-action self-validates that .github/workflows/claude.yml in
a PR is byte-identical to main and refuses to run if it has changed.
This blocks PR-driven updates to claude.yml even with admin merge,
because branch protection treats the failed claude-code check as a
required gate.

Keep this sweep PR focused on the other Tier 1 stubs that merge
cleanly. claude.yml will be updated via a follow-up direct change.

* chore: re-trigger CI after ruleset rename for centralized check names

* chore: re-evaluate merge state

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(workflows): bump claude.yml stub to @v1 and add SOURCE OF TRUTH header (#80)

Closes #79.

The file was already a thin caller stub but pointed at @main. Bumps to
@v1 (the canonical pinned version, see petry-projects/.github#88) and
prepends the standardized SOURCE OF TRUTH header so future agents know
what they may and may not edit.

This was deferred from petry-projects/markets#78 because claude-code-action's
GitHub App refuses to mint a token for any PR whose diff includes a
workflow file, and `claude-code / claude` was previously a required
status check on this repo. The check is no longer required (removed
yesterday from ruleset 14805963 and from classic branch protection),
so the expected `claude-code / claude` job failure on this PR will be
a non-blocking warning rather than a merge gate.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>

* chore(deps): bump github/codeql-action from 3.35.1 to 4.35.2 (#134)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.35.1 to 4.35.2.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/5c8a8a642e79153f5d047b10ec1cba1d1cc65699...95e58e9a2cdfd71adc6e0353d5c52f41a045d225)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: correct reusable workflow path (remove duplicate .github/) (#140)

fix: correct reusable workflow path (remove duplicate .github/ segment)

Changed: petry-projects/.github/.github/workflows/claude-code-reusable.yml
To:      petry-projects/.github/workflows/claude-code-reusable.yml

The path syntax was incorrect. When calling a reusable workflow from
another repository, the format is owner/repo/path/to/workflow.
The first .github is the repository name, not a path segment.

This fix resolves the "claude-code / claude" CI failure.

Relates to: https://github.com/petry-projects/.github/pull/154

Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>

* Revert "fix: correct reusable workflow path (remove duplicate .github/) (#140)"

This reverts commit 1bd2b8ce038508d6cc5bce7a5c3e96e75aec6096.

* ci: add auto-rebase workflow and check_run trigger to claude.yml

* add check_run trigger to claude.yml

* add auto-rebase.yml workflow

* chore: add bot accounts to CODEOWNERS for auto-merge support

* chore(deps): bump github/codeql-action from 4.35.2 to 4.35.3 (#150)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.2 to 4.35.3.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: standardize CODEOWNERS on @petry-projects/org-leads (#153)

Per the org-wide standard defined in petry-projects/.github
(standards/codeowners-standard.md), replace individual user/bot
listings with the @petry-projects/org-leads team.

Closes the CODEOWNERS gap from pr-review-agent#27.

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

* docs(codeowners): tighten comment to match org standard format (#160)

Update the CODEOWNERS header comment to be more concise and explicit
about the org standard rule (org-leads must be first on every line),
matching the recommended style from petry-projects/.github
standards/codeowners-standard.md.

Closes #155

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>

* chore(deps): bump github/codeql-action from 4.35.3 to 4.35.4 (#169)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.3 to 4.35.4.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/e46ed2cbd01164d986452f91f178727624ae40d7...68bde559dea0fdcac2102bfdf6230c5f70eb485e)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>

* fix: move CODEOWNERS to repo root for compliance audit compatibility (#167)

The compliance audit script checks CODEOWNERS locations in order:
root, .github/, docs/. A bug in the audit's gh_api wrapper causes
404 responses from the root-path check to be treated as valid
(non-empty) content, short-circuiting the loop before it reaches
the correct .github/CODEOWNERS.

Moving the file to the repo root ensures it is found on the first
check, bypassing the 404-handling bug and making the audit pass.

Closes #165

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml (#174)

* chore(dev-lead): remove claude.yml — replaced by dev-lead.yml

* fix(ruleset): replace claude-code/claude with Dev-Lead Agent/dispatch required status check

* fix(ruleset): correct required status check context to dev-lead/dispatch

The check context emitted by dev-lead.yml is `dev-lead / dispatch`
(caller job name / reusable job name), not `Dev-Lead Agent / dispatch`
(which would use the workflow name instead of the job name). Verified
against actual check names in broodly and TalkTerm PRs.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump github/codeql-action from 4.35.4 to 4.35.5 (#179)

Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.35.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#122)

* compliance: confirm and re-apply allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied
via GitHub API (gh api -X PATCH repos/petry-projects/markets
-F allow_auto_merge=true). The dependabot-automerge.yml workflow
already matches the org template verbatim.

Recurring null findings in the compliance audit are due to
ORG_SCORECARD_TOKEN lacking admin scope to read this field from
the GitHub REST API — a false positive at the audit level.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (#103)

* compliance: confirm allow_auto_merge is enabled (closes #89)

The repository setting allow_auto_merge is already true and
.github/workflows/dependabot-automerge.yml exists verbatim from the
org standard template. This commit formally closes the compliance
finding.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* compliance: confirm allow_auto_merge is enabled (closes #89) (#130)

* compliance: re-apply and confirm allow_auto_merge=true (closes #89)

Repository setting allow_auto_merge has been verified and re-applied via
GitHub API: gh api -X PATCH repos/petry-projects/markets -F allow_auto_merge=true

The dependabot-automerge.yml workflow is already present and matches the
org template verbatim.

Root cause of recurring audit findings: ORG_SCORECARD_TOKEN lacks the
administration:read permission needed to read allow_auto_merge from the
GitHub REST API. Without admin scope, the field returns null even though
the setting is enabled — a false positive. To permanently resolve, grant
ORG_SCORECARD_TOKEN admin-level access to the repository in
petry-projects/.github settings.

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* retrigger: bump workflows to run checks

---------

Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>

* feat: implement issue #170 — Compliance: secret_scanning_ai_detection (#188)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #93 — Compliance: stray-codeql-workflow (#196)

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml (#250)

* feat: implement issue #249 — [Fleet Monitor] petry-projects/markets — ci.yml

* chore: apply manual instructions [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(ci): auto-fix for SonarCloud Code Analysis [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present (#263)

* feat: implement issue #96 — Compliance: secret_scan_ci_job_present

* fix(bot): address bot feedback [skip ci-relay]

* chore: apply manual instructions [skip ci-relay]

---------

Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* fix: re-pin agent_ref inputs to v-form (missed by #657 uses:-only re-pin) (#319)

fix: re-pin agent_ref to v-form for add-to-project.yml [#657]

* feat: implement issue #301 — Compliance: non-stub-feature-ideation.yml

* chore: dev-lead update (review-changes) [skip ci-relay]

* fix(reviews): address review comments [skip ci-relay]

* chore: dev-lead update (review-changes) [skip ci-relay]

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Don Petry <don@djpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>
Co-authored-by: don-petry <don-petry@users.noreply.github.com>
Co-authored-by: dependabot-automerge-petry[bot] <270452309+dependabot-automerge-petry[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

* feat: implement issue #325 — Compliance: ruleset-drift-pr-quality-require_last_push_approval (#355)

* chore: add Dependabot with auto-merge via GitHub App (#2)

* chore: add Dependabot configuration

* chore: add Dependabot auto-merge workflow

* fix(ci): use pull_request_target for Dependabot secret access

* fix: remove gradle ecosystem from Dependabot config (#4)

* chore: add AGPL-3.0 + commercial dual licensing and CLA

Establish dual licensing model:
- AGPL-3.0 for open-source use
- Commercial license available for proprietary use
- Contributor License Agreement for all contributions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address review feedback — fix naming, wording, and license format

- Capitalize project name in README heading
- Fix AGPL description wording to be more accurate
- Rename LICENSE-COMMERCIAL.md heading to Commercial Licensing
- Move copyright notice from LICENSE to NOTICE file (AGPL requires verbatim text)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: standardize LICENSE file format and add copyright notice (#7)

* fix: standardize LICENSE file format and add copyright notice

Remove the "This program is free software..." preamble that was prepended
before the standard AGPL-3.0 text, which caused GitHub to classify the
license as "Other" instead of AGPL-3.0. Add project copyright notice.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(license): remove copyright line from verbatim AGPL-3.0 text

The FSF requires the LICENSE file to contain the verbatim AGPL-3.0
text without modifications. The project copyright is already in the
NOTICE file where it belongs.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Don Petry <don@donpetry.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: enable CodeRabbit for AI-powered PR reviews (#8)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore: refine CodeRabbit config to exclude non-code directories (#10)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Add Claude Code GitHub Action (#12)

* Add Claude Code GitHub Action for PR reviews

* fix: address review feedback on Claude Code workflow

- Restrict issue_comment trigger to PR comments only
- Add author-association check (OWNER/MEMBER/COLLABORATOR)
- Add pull_request_review_comment trigger
- Add timeout-minutes to prevent runaway jobs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use CLAUDE_CODE_OAUTH_TOKEN org secret

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add id-token: write permission for OAuth auth

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address remaining review comments

- Pin claude-code-action to commit SHA for supply-chain safety
- Add fork PR guard (secrets unavailable for fork PRs)
- Scope pull_request trigger to main branch
- Use >- folded scalar for if expression

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address OpenSSF Scorecard findings (#20)

* fix: address OpenSSF Scorecard findings

- Add SECURITY.md (#15)
- Scope workflow token permissions to least privilege (#16)
- Pin action dependencies to SHAs (#17)
- Add CodeQL SAST workflow for all commits (#18)
- Ensure CI runs on all PRs (#19)

Closes #15, #16, #17, #18, #19

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review comments

- Replace permissions: read-all with permissions: {} (deny-by-default)
  in all workflow files (claude, codeql, dependabot-automerge, sonarcloud)
- Add concrete security contact email to SECURITY.md
- No CI test workflow needed: repo contains no source code or tests

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: use claude_code_oauth_token instead of anthropic_api_key

The action has separate inputs for API keys vs OAuth tokens.
CLAUDE_CODE_OAUTH_TOKEN is an OAuth token, not an API key.

* fix: use relative URL for security advisory link

Address CodeRabbit nitpick — relative URL works for forks/renames.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: skip Claude Code reviewer on Dependabot PRs (#36)

* ci: skip Claude Code reviewer on Dependabot PRs

The claude workflow fails on Dependabot PRs because secrets
(CLAUDE_CODE_OAUTH_TOKEN) are not available to the dependabot actor.
This blocks the dependabot auto-merge automation when claude is a
required status check.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: use PR author login instead of github.actor for Dependabot check

github.actor reflects who triggered the workflow run (e.g. a maintainer
reopening), not the PR author. Use github.event.pull_request.user.login
for reliable Dependabot detection, consistent with dependabot-automerge.yml.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump actions/checkout from 4.3.1 to 6.0.2 (#34)

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/34e114876b0b11c390a56381ad16ebd13914f8d5...de0fac2e4500dabe0009e67214ff5f5447ce83dd)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.82 (#33)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.82.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...88c168b39e7e64da0286d812b6e9fbebb6708185)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.82
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: move Dependabot exclusion to step-level in Claude workflow (#37)

* ci: move Dependabot exclusion to step-level in Claude workflow

Move the dependabot[bot] check from job-level `if` to step-level `if`
so the claude job runs and reports SUCCESS (with a skipped step) instead
of being skipped entirely. A skipped job doesn't satisfy required status
checks in branch protection, but a successful job with a skipped step does.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* ci: guard step-level Dependabot check for pull_request events only

The step-level if needs to handle issue_comment and
pull_request_review_comment events where github.event.pull_request
is not present. Use event_name guard to avoid null dereference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-Air.localdomain>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* chore(deps): bump anthropics/claude-code-action from 1.0.80 to 1.0.88 (#41)

Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.80 to 1.0.88.
- [Release notes](https://github.com/anthropics/claude-code-action/releases)
- [Commits](https://github.com/anthropics/claude-code-action/compare/094bd24d575e7b30ac1576024817bf1a97c81262...1eddb334cfa79fdb21ecbe2180ca1a016e8e7d47)

---
updated-dependencies:
- dependency-name: anthropics/claude-code-action
  dependency-version: 1.0.88
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore: enable Claude issue trigger per org CI standard (#53)

Add issues:[labeled] event trigger and claude label support so Claude
can work issues autonomously — reading the issue, creating a branch,
implementing the fix, and opening a PR.

Matches the standard defined in petry-projects/.github#24.

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add checkout step to Claude workflow for issue-triggered mode (#54)

The claude-code-action runs git fetch/checkout internally during branch
setup but requires the repository to already be cloned on the runner.
Without actions/checkout, issue-triggered runs fail with:
  fatal: not a git repository

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: split Claude workflow into interactive + issue automation jobs (#63)

* feat: split Claude workflow into interactive + issue automation jobs

Aligns with the org standard in petry-projects/.github. The claude-issue
job runs in automation mode with tools to create PRs, self-review,
check CI, and tag code owners when ready.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: add concurrency guard and comment tools to claude-issue job

- Add concurrency group keyed on issue number to prevent duplicate runs
- Add gh pr comment and gh issue comment to allowedTools for review
  replies, thread resolution, and code owner tagging
- Remove Bash(cat:*) since the Read tool already covers file reads

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: DJ <dj@Rachels-MacBook-Air.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: switch to org-level reusable Claude Code workflow (#64)

* chore: add CODEOWNERS file for code owner review enforcement

Resolves compliance finding #missing-codeowners by adding .github/CODEOWNERS
assigning @don-petry as the default owner for all files.

Closes #52

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

* chore(workflows): adopt centralized stubs from petry-projects/.github (#78)

* chore(workflows): adopt centralized stubs from petry-projects/.github

Replace inline copies of standardized workflows with the canonical
thin caller stubs from petry-projects/.github/standards/workflows/.
Each stub delegates to a versioned reusable workflow at
petry-projects/.github/.github/workflows/<name>-reusable.yml@v1, so
future updates to th…
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants