fix(compliance): secret-scan job, pin dtolnay action, exempt internal reusable refs#260
fix(compliance): secret-scan job, pin dtolnay action, exempt internal reusable refs#260don-petry wants to merge 7 commits into
Conversation
…rnal reusable refs - ci.yml: add required secret-scan job using gitleaks (per push-protection.md#required-ci-job), fixing the secret_scan_ci_job_present error for .github repo - dependency-audit.yml: pin dtolnay/rust-toolchain@stable to SHA 29eef336d9b2848a0b548edc03f92a220660cdb8, fixing unpinned-actions-dependency-audit.yml - compliance-audit.sh: exempt petry-projects/.github reusable workflow refs from SHA-pinning check — ci-standards.md#action-pinning-policy explicitly allows @v1/@main for internal reusables; the missing exemption caused false positives for agent-shield.yml, claude.yml, and dependabot-automerge.yml across all repos Closes #259 Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
📝 WalkthroughWalkthroughThis PR implements gitleaks CLI-based secret scanning for CI, documents the standard approach, updates compliance validation scripts to recognize both gitleaks action and CLI patterns, excludes internal reusable workflows from action pinning checks, and pins a workflow action SHA. ChangesGitleaks CLI Secret Scanning
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the compliance audit script to exclude reusable workflows from the petry-projects organization from SHA-pinning requirements, aligning with internal policies. The review feedback recommends replacing the hardcoded organization name with the existing ORG variable and using [[:space:]] in the regex for consistency with the rest of the script.
| # Exclude petry-projects/.github reusable workflow refs — these use tag refs | ||
| # (@v1, @main) by design per ci-standards.md#action-pinning-policy | ||
| local unpinned | ||
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' || true) | ||
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' | grep -vE 'uses:[[:space:]]+petry-projects/\.github/' || true) |
There was a problem hiding this comment.
The organization name petry-projects is hardcoded in both the comment and the regex. Since the script defines an ORG variable at line 25 and uses it consistently throughout the file, it should be used here as well to maintain portability and avoid duplication. Additionally, using [[:space:]] instead of \s in the first grep improves consistency with the rest of the script (e.g., line 221).
| # Exclude petry-projects/.github reusable workflow refs — these use tag refs | |
| # (@v1, @main) by design per ci-standards.md#action-pinning-policy | |
| local unpinned | |
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' || true) | |
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' | grep -vE 'uses:[[:space:]]+petry-projects/\.github/' || true) | |
| # Exclude $ORG/.github reusable workflow refs — these use tag refs | |
| # (@v1, @main) by design per ci-standards.md#action-pinning-policy | |
| local unpinned | |
| unpinned=$(echo "$decoded" | grep -E '^[[:space:]]*-?[[:space:]]*uses:[[:space:]]+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' | grep -vE "uses:[[:space:]]+$ORG/\.github/" || true) |
There was a problem hiding this comment.
Pull request overview
This PR addresses compliance audit findings in the .github repo by adding the required gitleaks secret-scanning CI job, pinning an unpinned GitHub Action dependency, and reducing false positives in the compliance audit’s action-pinning check for internal reusable workflows.
Changes:
- Add a
secret-scanjob to.github/workflows/ci.ymlusinggitleaks/gitleaks-actionwith full-history checkout. - Pin
dtolnay/rust-toolchain@stableto a specific commit SHA in.github/workflows/dependency-audit.yml. - Update
scripts/compliance-audit.shto exemptpetry-projects/.githubinternal reusable workflow refs from SHA-pinning findings.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
scripts/compliance-audit.sh |
Exempts internal petry-projects/.github reusable workflow refs from action SHA-pinning findings. |
.github/workflows/dependency-audit.yml |
Pins dtolnay/rust-toolchain to a commit SHA to satisfy action pinning policy. |
.github/workflows/ci.yml |
Adds the required gitleaks-based secret-scan job with full-history checkout. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| with: | ||
| args: detect --source . --redact --verbose --exit-code 1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| security-events: write | ||
| steps: | ||
| - name: Checkout (full history) | ||
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 |
| # Exclude petry-projects/.github reusable workflow refs — these use tag refs | ||
| # (@v1, @main) by design per ci-standards.md#action-pinning-policy | ||
| local unpinned | ||
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' || true) | ||
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' | grep -vE 'uses:[[:space:]]+petry-projects/\.github/' || true) | ||
|
|
gitleaks/gitleaks-action v2 requires a paid license key for GitHub organization repos. Add GITLEAKS_LICENSE env var to the secret-scan job and document the requirement in push-protection.md so all adopting repos know to configure the GITLEAKS_LICENSE org secret. Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
…irement gitleaks-action v2 requires a paid license for GitHub org repos. Switch to go install github.com/zricethezav/gitleaks/v8@v8.30.1 which is free and uses Go's checksum database (sum.golang.org) for integrity verification. - ci.yml: replace action with go install + CLI run - push-protection.sh: accept 'gitleaks detect' CLI invocations alongside the action pattern in the secret_scan_ci_job_present compliance check - push-protection.md: update canonical job template to CLI approach and document why (org license requirement), note action as option with license Co-authored-by: Don Petry <don-petry@users.noreply.github.com>
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Run gitleaks | ||
| run: | | ||
| go install github.com/zricethezav/gitleaks/v8@v8.30.1 |
|
@petry-projects/org-leads — this PR is ready for review. All required CI checks pass (Lint, ShellCheck, AgentShield, CodeQL, Secret scan). What this fixes:
Still needs manual action: repo settings ( The SonarCloud quality gate appears to have pre-existing issues (unrelated to this PR). |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/compliance-audit.sh`:
- Around line 212-215: The current unpinned extraction in the unpinned variable
excludes any uses: petry-projects/.github/ reference, which hides unpinned
internal actions; update the grep exclusion to only skip reusable-workflow
references by changing the final grep -vE pattern in the unpinned assignment
(the line starting with unpinned=$(echo "$decoded" | ...) ) to match only paths
that reference reusable workflows, e.g. replace grep -vE
'uses:[[:space:]]+petry-projects/\.github/' with grep -vE
'uses:[[:space:]]+petry-projects/\.github/.*workflows/' so only
petry-projects/.github/.../workflows/* calls are exempted.
In `@scripts/lib/push-protection.sh`:
- Around line 203-206: The current grep against ci_content accepts any "gitleaks
detect" occurrence including inside comments/strings; update the regex in the if
condition that checks ci_content (the grep invocation) to only match real
command invocations by requiring the match occur on a line that does not begin
with a comment (allow leading whitespace) and by using word boundaries/anchors
so "gitleaks detect" is matched as a standalone command (e.g., line-level match
with optional leading whitespace, not preceded by '#', and \b around gitleaks
and detect). Modify the grep/regex used in the if (! echo "$ci_content" | grep
-qE '...') check accordingly to avoid comment/string false positives.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 44384b99-3cd8-4a9f-b279-068a619d1d85
📒 Files selected for processing (5)
.github/workflows/ci.yml.github/workflows/dependency-audit.ymlscripts/compliance-audit.shscripts/lib/push-protection.shstandards/push-protection.md
| # Exclude petry-projects/.github reusable workflow refs — these use tag refs | ||
| # (@v1, @main) by design per ci-standards.md#action-pinning-policy | ||
| local unpinned | ||
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' || true) | ||
| unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' | grep -vE 'uses:[[:space:]]+petry-projects/\.github/' || true) |
There was a problem hiding this comment.
Scope the internal pinning exemption to reusable workflow paths only.
Line 215 currently exempts every uses: petry-projects/.github/... reference, which can hide genuinely unpinned internal actions. Limit the exemption to reusable workflow calls only (the intended @v1/@main case).
Suggested fix
- unpinned=$(echo "$decoded" | grep -E '^\s*-?\s*uses:\s+[^#]*@' | grep -vE '@[0-9a-f]{40}' | grep -vE '(docker://|\.\/)' | grep -vE 'uses:[[:space:]]+petry-projects/\.github/' || true)
+ unpinned=$(echo "$decoded" \
+ | grep -E '^\s*-?\s*uses:\s+[^#]*@' \
+ | grep -vE '@[0-9a-f]{40}' \
+ | grep -vE '(docker://|\.\/)' \
+ | grep -vE 'uses:[[:space:]]+petry-projects/\.github/\.github/workflows/[^@]+@(v1|main)\b' \
+ || true)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/compliance-audit.sh` around lines 212 - 215, The current unpinned
extraction in the unpinned variable excludes any uses: petry-projects/.github/
reference, which hides unpinned internal actions; update the grep exclusion to
only skip reusable-workflow references by changing the final grep -vE pattern in
the unpinned assignment (the line starting with unpinned=$(echo "$decoded" |
...) ) to match only paths that reference reusable workflows, e.g. replace grep
-vE 'uses:[[:space:]]+petry-projects/\.github/' with grep -vE
'uses:[[:space:]]+petry-projects/\.github/.*workflows/' so only
petry-projects/.github/.../workflows/* calls are exempted.
| # Accept either the gitleaks action or the gitleaks CLI. | ||
| # The action requires a paid org license (gitleaks.io); the CLI via | ||
| # go install github.com/zricethezav/gitleaks/v8 is a license-free alternative. | ||
| if ! echo "$ci_content" | grep -qE '(uses:[[:space:]]*(gitleaks/gitleaks-action|zricethezav/gitleaks-action)@|gitleaks[[:space:]]detect)'; then |
There was a problem hiding this comment.
Harden the gitleaks CLI matcher to avoid comment/string false positives.
Line 206 accepts any gitleaks detect text anywhere in ci.yml, including comments. That can incorrectly mark non-compliant workflows as compliant.
Suggested fix
- if ! echo "$ci_content" | grep -qE '(uses:[[:space:]]*(gitleaks/gitleaks-action|zricethezav/gitleaks-action)@|gitleaks[[:space:]]detect)'; then
+ if ! echo "$ci_content" | grep -qE '(^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*(gitleaks/gitleaks-action|zricethezav/gitleaks-action)@|^[[:space:]]*gitleaks[[:space:]]+detect([[:space:]]|$))'; then📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # Accept either the gitleaks action or the gitleaks CLI. | |
| # The action requires a paid org license (gitleaks.io); the CLI via | |
| # go install github.com/zricethezav/gitleaks/v8 is a license-free alternative. | |
| if ! echo "$ci_content" | grep -qE '(uses:[[:space:]]*(gitleaks/gitleaks-action|zricethezav/gitleaks-action)@|gitleaks[[:space:]]detect)'; then | |
| # Accept either the gitleaks action or the gitleaks CLI. | |
| # The action requires a paid org license (gitleaks.io); the CLI via | |
| # go install github.com/zricethezav/gitleaks/v8 is a license-free alternative. | |
| if ! echo "$ci_content" | grep -qE '(^[[:space:]]*-?[[:space:]]*uses:[[:space:]]*(gitleaks/gitleaks-action|zricethezav/gitleaks-action)@|^[[:space:]]*gitleaks[[:space:]]+detect([[:space:]]|$))'; then |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/lib/push-protection.sh` around lines 203 - 206, The current grep
against ci_content accepts any "gitleaks detect" occurrence including inside
comments/strings; update the regex in the if condition that checks ci_content
(the grep invocation) to only match real command invocations by requiring the
match occur on a line that does not begin with a comment (allow leading
whitespace) and by using word boundaries/anchors so "gitleaks detect" is matched
as a standalone command (e.g., line-level match with optional leading
whitespace, not preceded by '#', and \b around gitleaks and detect). Modify the
grep/regex used in the if (! echo "$ci_content" | grep -qE '...') check
accordingly to avoid comment/string false positives.
|
Auto-rebase blocked — the base branch contains Please rebase this branch manually: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Please resolve the conflicts and push: |
Superseded by automated re-review at
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
Auto-rebase: Conflicts Require Manual ResolutionThe automated rebase of Conflicts Detected1.
|
| PR branch | main |
|
|---|---|---|
| Concurrency group | ci-${{ github.ref }} |
ci-${{ github.ref }}-${{ github.sha }} |
| Gitleaks install | actions/setup-go + go install ...@v8.30.1 |
Manual wget download with SHA-256 checksum verification |
| Run command | gitleaks detect --source . --redact ... |
gitleaks detect --source . --config .gitleaks.toml --redact ... |
| Checkout comment | # v4 |
# v6.0.2 |
This is not an action-pin conflict (the SHA is the same on both sides). It is an implementation conflict requiring a deliberate choice.
2. scripts/compliance-audit.sh
The PR and main made complementary but non-overlapping changes to this shell script:
- PR branch adds: exemption for
petry-projects/.githubreusable workflow refs incheck_action_pinning(grep filter + comments) - main adds: new
check_ci_concurrencyfunction + its call inmain()(checks thatci.ymlconcurrency group includesgithub.sha)
These changes are in nearby code regions and will conflict during rebase. A correct merge keeps both changes.
Why Auto-Resolution Was Skipped
Per the auto-rebase policy:
- Action-pin conflicts in workflow YAML files can be resolved automatically by comparing versions.
- All other conflicts — including implementation differences in workflow jobs and changes to shell scripts — must be resolved by a human.
Manual Resolution Steps
git fetch origin
git checkout claude/issue-259-20260512-1836
git rebase origin/mainFor .github/workflows/ci.yml — prefer main's version (it already has the secret-scan job with a better, checksum-verified gitleaks install and the SHA-scoped concurrency group):
git checkout --ours -- .github/workflows/ci.yml
git add .github/workflows/ci.ymlFor scripts/compliance-audit.sh — manually merge to keep both changes:
- Keep
main'scheck_ci_concurrencyfunction (lines ~638–676) and its call inmain(). - Keep the PR's
petry-projects/.githubexemption incheck_action_pinning(thegrep -vE 'uses:[[:space:]]+petry-projects/\.github/'filter and surrounding comments).
# After editing the file to include both changes:
git add scripts/compliance-audit.sh
git rebase --continue
git push --force-with-leaseNote: If
main'sci.ymlalready satisfies the original compliance findings this PR addressed (secret-scan job present, dtolnay pinned), consider whether thecompliance-audit.shpetry-projects exemption is still needed before re-pushing.
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase could not be completed automatically The automated rebase agent examined this PR and found conflicts that cannot be safely resolved without human review. Conflicting files
Neither conflict is a simple action-pin version bump, so the resolution policy requires a human to resolve them. Manual resolution stepsgit fetch origin
git checkout claude/issue-259-20260512-1836
git rebase origin/main
# resolve conflicts in:
# .github/workflows/auto-rebase-reusable.yml
# .github/workflows/ci.yml
git add .github/workflows/auto-rebase-reusable.yml
git add .github/workflows/ci.yml
git rebase --continue
git push --force-with-leaseGuidance for the conflicting files
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
Auto-Rebase Status: Blocked by Permission SandboxThe auto-rebase workflow was triggered for PR #260 but could not complete. All git write operations ( To fix this permanently, commit {
"permissions": {
"allow": [
"Bash(git fetch origin *)",
"Bash(git fetch origin)",
"Bash(git rebase *)",
"Bash(git push --force-with-lease)",
"Bash(git push --force-with-lease *)",
"Bash(git config user.name *)",
"Bash(git config user.email *)",
"Bash(gh pr checkout *)",
"Bash(gh pr comment *)"
]
}
}To resolve this PR manually in the meantime: git fetch origin
git checkout claude/issue-259-20260512-1836
git rebase origin/main
# resolve conflicts in .github/workflows/*.yml if any
git add <resolved-files>
git rebase --continue
git push --force-with-lease |
Auto-Rebase Aborted — Two Blockers FoundThe rebase could not be completed due to two independent issues: Blocker 1: Shallow CloneThe checkout is a shallow clone ( Fix: Add Blocker 2: Permission SandboxAll git write operations ( Fix: Commit {
"permissions": {
"allow": [
"Bash(git fetch origin *)",
"Bash(git fetch origin)",
"Bash(git fetch --unshallow)",
"Bash(git rebase *)",
"Bash(git push --force-with-lease)",
"Bash(git push --force-with-lease *)",
"Bash(git config user.name *)",
"Bash(git config user.email *)",
"Bash(gh pr checkout *)",
"Bash(gh pr comment *)"
]
}
}Manual Resolutiongit fetch --unshallow
git fetch origin
git checkout claude/issue-259-20260512-1836
git rebase origin/main
# If conflicts occur in .github/workflows/*.yml (action pin SHAs):
# - Compare versions on both sides and keep the newer one
# - git add <resolved-file>
# - git rebase --continue
git push --force-with-leaseThe files changed by this PR are:
|
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
@dev-lead - please fix this PR |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
Superseded by automated re-review at
|
Review — fix requested (cycle 3/3)The automated review identified the following issues. Please address each one: Findings to fixAutomated review — NEEDS HUMAN REVIEWRisk: MEDIUM SummaryPR adds gitleaks secret scanning, pins dtolnay/rust-toolchain to SHA, and fixes compliance-script false positives for internal reusable workflow refs. Risk is MEDIUM and three gates are failing: (1) the branch has been in merge conflict with main for 18+ days with repeated auto-rebase failures, (2) SonarCloud reports a C Security Rating on new code, and (3) coderabbitai CHANGES_REQUESTED on a correctness bug in the regex exemption have not been addressed — the PR HEAD SHA is unchanged since the prior review cycle. Findings
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review. Additional tasks
The review cascade will automatically re-review after new commits are pushed. |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
Automated review — human attention neededThis PR has been through 3 automated review cycles (cap: 3) without converging on an approval-and-merge state. Further automated review has been paused to avoid infinite loops. Please take a look manually, or close this PR if it's no longer needed. Once a human review resolves the situation, remove the Posted by the donpetry-bot PR-review cascade. |
Summary
Fixes three compliance findings from the 2026-05-12 audit for the
.githubrepo:secret_scan_ci_job_present(error): Adds the requiredsecret-scanjob toci.ymlusinggitleaks/gitleaks-actionwith full-history scanning, perstandards/push-protection.md#required-ci-job.unpinned-actions-dependency-audit.yml(error): Pinsdtolnay/rust-toolchain@stableto commit SHA29eef336d9b2848a0b548edc03f92a220660cdb8per the Action Pinning Policy.unpinned-actions-agent-shield.yml,unpinned-actions-claude.yml,unpinned-actions-dependabot-automerge.yml(error — false positives across all repos): Fixes the compliance script to exemptpetry-projects/.githubreusable workflow refs. Perstandards/ci-standards.md#action-pinning-policy, internal reusables use@v1/@maintags by design and are explicitly exempt from SHA pinning. The missing exemption incheck_action_pinning()caused false positives for all thin-caller stubs fleet-wide.Not addressed in this PR (require
apply-repo-settings.sh)The following findings require API-level changes that cannot be made via file PR:
allow_auto_merge,delete_branch_on_merge— runapply-repo-settings.sh .githubcheck-suite-auto-trigger-1236702,check-suite-auto-trigger-347564— runfix-check-suite-prefs.shsecret_scanning_ai_detection,secret_scanning_non_provider_patterns— runapply-repo-settings.sh .github* @petry-projects/org-leads); likely stale audit findingsTest plan
secret-scanjob.githubfor SHA-pinning false positives after this mergesdependency-audit.ymlRust step uses pinned SHACloses #259
Generated with Claude Code
Summary by CodeRabbit
Release Notes
New Features
Chores