fix(compliance): add CLAUDE.md and dependabot.yml by don-petry · Pull Request #152 · petry-projects/.github-private

don-petry · 2026-05-12T19:12:58Z

Summary

Adds CLAUDE.md with required AGENTS.md reference (fixes claude-md-missing-agents-ref)
Adds .github/dependabot.yml with github-actions ecosystem, security and dependencies labels (fixes missing-github-actions-ecosystem, missing-security-label, missing-dependencies-label)

Compliance findings addressed

Finding	Severity	Status
`claude-md-missing-agents-ref`	error	✅ Fixed
`missing-github-actions-ecosystem`	error	✅ Fixed
`missing-security-label`	warning	✅ Fixed
`missing-dependencies-label`	warning	✅ Fixed

Remaining findings requiring human action

The following findings for .github-private require elevated permissions not available to this agent:

Workflow files (missing-ci.yml, missing-pr-review-mention.yml, non-stub-auto-rebase.yml, non-stub-dependabot-automerge.yml, non-stub-agent-shield.yml) — require workflows write permission
SHA pinning in workflow files (unpinned-actions-*) — require workflows write permission
Repository settings (allow_auto_merge, delete_branch_on_merge, check-suite-auto-trigger-*) — run bash scripts/apply-repo-settings.sh .github-private with admin credentials
Secret scanning settings — run bash scripts/apply-repo-settings.sh .github-private

Part of petry-projects/.github#261

Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated internal project documentation and configuration guidelines.

coderabbitai · 2026-05-12T19:13:16Z

Warning

Review limit reached

@don-petry, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 59 minutes and 49 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 169c921b-39c2-486f-90a4-19ec36942e0b

📥 Commits

Reviewing files that changed from the base of the PR and between b34e302 and 2508628.

📒 Files selected for processing (2)

.github/dependabot.yml
CLAUDE.md

📝 Walkthrough

Walkthrough

Added CLAUDE.md with repository-specific Claude Code guidance, directing agents to org-wide standards in AGENTS.md, defining the .github-private repository's purpose and structure, and establishing operational rules for shell script editing and GitHub Actions SHA pinning.

Changes

Repository Development Guidance for Claude Code

Layer / File(s)	Summary
Claude Code repository guidance `CLAUDE.md`	New file establishes development standards for Claude Code usage in `.github-private`, references org-wide `AGENTS.md` standards, documents repository contents (agents, scripts, workflows), and defines operational rules: shell scripts must pass `shellcheck` and GitHub Actions must pin SHAs via GitHub API lookup.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related issues

Compliance: unpinned-actions-claude.yml .github#105: CLAUDE.md guidance on pinning action SHAs directly addresses the unpinned-action finding for claude.yml.
Compliance audit — 2026-05-08 .github#215: Added CLAUDE.md in .github-private matches the requested documentation update to CLAUDE.md/AGENTS.md.
Compliance audit — 2026-05-12 .github#261: CLAUDE.md addition with action SHA pinning and workflow practices guidance directly addresses compliance audit findings.
Compliance audit — 2026-05-12 .github#250: Both changes modify .github-private/CLAUDE.md, adding AGENTS.md reference and action SHA pinning guidance.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title references both CLAUDE.md and dependabot.yml, but the raw summary only documents CLAUDE.md changes; dependabot.yml is not mentioned or summarized.	Either update the title to reflect only the documented changes (e.g., 'fix(compliance): add CLAUDE.md'), or confirm that dependabot.yml changes are included and ensure they are documented in the summary.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch claude/issue-261-compliance

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request introduces a Dependabot configuration for GitHub Actions and a CLAUDE.md file to provide context and guidelines for Claude Code. The review feedback suggests bundling Dependabot updates into groups to reduce noise, expanding the repository purpose section to include missing directories, and adding a commands section for common tasks like shell script linting.

gemini-code-assist · 2026-05-12T19:14:38Z

+- **`agents/`** — Copilot custom agent profiles (org-wide, invocable from GitHub.com, VS Code, JetBrains)
+- **`scripts/`** — Shell orchestration for GitHub Actions (PR review, health checks)
+- **`.github/workflows/`** — Scheduled automation (PR review, health checks, dependency audit)


The "Repository Purpose" section is missing the prompts/ and frameworks/ directories, which are key components of this repository as described in the README.md and AGENTS.md. Including them provides essential context for the agent's understanding of the project structure.

Suggested change

- **`agents/`** — Copilot custom agent profiles (org-wide, invocable from GitHub.com, VS Code, JetBrains)

- **`scripts/`** — Shell orchestration for GitHub Actions (PR review, health checks)

- **`.github/workflows/`** — Scheduled automation (PR review, health checks, dependency audit)

- **`agents/`** — Copilot custom agent profiles (org-wide, invocable from GitHub.com, VS Code, JetBrains)

- **`prompts/`** — Prompt libraries used by workflows

- **`scripts/`** — Shell orchestration for GitHub Actions (PR review, health checks)

- **`frameworks/`** — Installed agentic frameworks (git subtree)

- **`.github/workflows/`** — Scheduled automation (PR review, health checks, dependency audit)

gemini-code-assist · 2026-05-12T19:14:39Z

+## Key Guidelines
+
+- This repo contains shell scripts executed by GitHub Actions — test changes locally with `shellcheck`
+- Workflow files here are non-stub (not thin callers) — they contain org-private automation logic
+- SHAs for action pinning must be looked up via the GitHub API — never guessed


CLAUDE.md files are most effective for Claude Code when they include a "Commands" section for common tasks like linting. This allows the agent to verify its work autonomously using the tools mentioned in the guidelines.

Suggested change

## Key Guidelines

- This repo contains shell scripts executed by GitHub Actions — test changes locally with `shellcheck`

- Workflow files here are non-stub (not thin callers) — they contain org-private automation logic

- SHAs for action pinning must be looked up via the GitHub API — never guessed

## Key Guidelines

- This repo contains shell scripts executed by GitHub Actions — test changes locally with `shellcheck`

- Workflow files here are non-stub (not thin callers) — they contain org-private automation logic

- SHAs for action pinning must be looked up via the GitHub API — never guessed

## Commands

- Lint shell scripts: `shellcheck scripts/*.sh`

Copilot

Pull request overview

Adds missing compliance artifacts for this org-level .github-private repository: Claude Code instructions and Dependabot configuration for GitHub Actions updates.

Changes:

Add CLAUDE.md with a reference to AGENTS.md and repository-specific guidance.
Add .github/dependabot.yml to enable weekly GitHub Actions dependency updates with security and dependencies labels.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
`CLAUDE.md`	Adds Claude Code repo instructions and points contributors to `AGENTS.md` standards.
`.github/dependabot.yml`	Enables Dependabot for the `github-actions` ecosystem with standard labels.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2026-05-13T16:28:31Z

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved manually.

Please resolve the conflicts and push:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

donpetry-bot · 2026-05-14T00:39:37Z

Superseded by automated re-review at 881d6da3448bdc81863695ad5150975e4723e9d2 — click to expand prior review.

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

Resolve all unresolved review thread comments from other reviewers
Ensure all CI checks pass after your changes
Rebase on the target branch if behind
Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

donpetry-bot · 2026-05-14T20:15:00Z

Superseded by automated re-review at 5e0577b6e6511b9b3ebe4d5b2bbee79f622d5f5a — click to expand prior review.

Review — fix requested (cycle 2/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

Resolve all unresolved review thread comments from other reviewers
Ensure all CI checks pass after your changes
Rebase on the target branch if behind
Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

donpetry-bot · 2026-05-14T20:37:28Z

Review — fix requested (cycle 3/3)

The automated review identified the following issues. Please address each one:

Findings to fix

[Findings would be inserted here]

Additional tasks

Resolve all unresolved review thread comments from other reviewers
Ensure all CI checks pass after your changes
Rebase on the target branch if behind
Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.

- Add groups bundling to dependabot.yml for GitHub Actions updates - Add prompts/ and frameworks/ directories to CLAUDE.md Repository Purpose - Correct inaccurate "non-stub" claim; clarify which workflows are thin callers - Add Commands section with shellcheck lint command Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

don-petry · 2026-05-16T19:20:59Z