.github-private

Org-wide Copilot custom agents, automated workflows, prompts, scripts, and frameworks for petry-projects.

What This Repo Does

This is the .github-private convention repo for the petry-projects org. Agent profiles in /agents/ are available org-wide — invocable from GitHub.com, VS Code, JetBrains, and Copilot CLI.

It also contains automated workflows (GitHub Actions agents running on events and schedules), prompts, scripts, and the scheduled reporting dashboards that run across the org.

It also contains the scheduled PR review automation (workflows + scripts + prompts) that runs hourly across the org.

Structure

agents/                   # Copilot custom agent profiles (org-wide)
  agentic-workflows.md    # Agentic workflow orchestration
  compliance-auditor.md   # Org standards compliance checking
  feature-ideator.md      # Feature idea generation
  pr-reviewer.md          # Multi-tier cascading PR review
prompts/                  # Prompt libraries used by workflows
scripts/                  # Shell orchestration for GitHub Actions
frameworks/               # Installed agentic frameworks (git subtree)
  bmad-bgreat-suite/      # bmad-bgreat-suite @ ae8914e84b87: SRE, DevOps, and Security agents
  bmad-method/            # BMAD-METHOD v6.8.0: multi-agent development lifecycle
  bmad-test-architecture/ # bmad-method-test-architecture-enterprise v1.19.0
.github/workflows/        # Scheduled automation (PR review, health checks)

@-Mention Agents

Agent	Purpose	Invoke with
agentic-workflows	Agentic workflow orchestration	@agentic-workflows in any org repo
compliance-auditor	Audit repo against org standards	@compliance-auditor in any org repo
feature-ideator	Generate and prioritize feature ideas	@feature-ideator in any org repo
pr-reviewer	Cascading PR review (triage → deep → security audit) with cross-engine adversarial review (see also pr-review-trigger.yml for scheduled automation)	@pr-reviewer in any org PR

Automated Workflows

Autonomous agents that run as GitHub Actions, triggered by events or schedules across the org.

Workflow	Purpose
ci-failure-analyst-reusable.yml	CI failure analyst — diagnoses failed CI/Lint/Test runs and comments root-cause analysis
feature-ideation.yml	Feature research & ideation agent (BMAD Analyst) — turns sources into scoped feature ideas
idea-triage.yml	Idea triage agent — scores queued ideas and promotes them into the backlog
initiative-driver.yml	Initiative driver — auto-releases an epic's ready sub-issues to Dev-Lead
initiative-planner.yml	Initiative planner (BMAD Scrum Master) — breaks an approved initiative into an epic + sub-issues
issue-triage-runner.yml	Issue triage agent — labels and routes newly opened issues
pr-review-trigger.yml	PR review agent — cascading triage → deep → security review on open PRs across the org; auto-approves LOW/MEDIUM risk PRs with passing CI, escalates HIGH risk to human review (see also @pr-reviewer). Trigger manually: gh workflow run pr-review-trigger.yml --repo petry-projects/.github-private or comment @petry-review-bot on any org PR
release-notes.yml	Release-notes agent — drafts Keep-a-Changelog entries from merged PRs and opens a CHANGELOG PR
stale-manager.yml	Stale manager agent — warns and closes stale issues/PRs across the org

Reporting & Dashboards

Scheduled workflows post reports and dashboards as issues or run summaries for maintainers.

In this repo (.github-private):

Workflow	Purpose
actions-fleet-monitor.yml	Actions fleet monitor — org-wide workflow token usage and run anomalies
auto-rebase-health.yml	Daily auto-rebase health report (issue) — rebase success/failure trends
daily-pr-review-health.yml	Daily PR-review health check — flags PR-review agent failures as an issue
docs-health-check.yml	Docs health check — flags stale/broken docs as an issue
engine-token-liveness.yml	Engine-token liveness monitor — asserts dev-lead/pr-review caller stubs are not failing at the "Engine token preflight" step, and escalates a sustained fleet-wide outage that would otherwise go unalerted (#1587)
premature-closure-audit.yml	Premature-closure audit — flags issues closed as completed with no merged closing PR, and OPEN issues carrying an unbacked completion claim (#1445)
reviewer-report.yml	Reviewer scorecard (per workflow-run summary) — per-reviewer PR-review activity
skill-eval-report.yml	Skill-eval results report — agent skill pass/fail trends (self-improving-skills pipeline)
token-report.yml	LLM token-cost report (per workflow-run summary) for maintainers

In .github (org-level):

Workflow	Purpose
compliance-audit-and-improvement.yml	Weekly org standards compliance audit + runtime health survey, with per-finding remediation issues
daily-org-status.yml	Daily "Org Status" digest posted as an issue for maintainers
org-scorecard.yml	Weekly OpenSSF Scorecard security-posture review across public repos; findings tracked as issues
standards-deploy.yml	Weekly fleet sweep that opens standards-sync PRs for repos drifted off the org-standard workflow stubs

Standards

Engineering standards live in petry-projects/.github/standards/. Notable subtopics are listed below to aid discoverability; see the standards directory for full documentation.

Standard	Notable subtopics
advanced-security	Code Security Configurations, push-protection live-fire (canary), licensing & billing, compliance audit checks
agent-rate-limits	Token-budget breaker, canary scope (enforcing vs log-only), daily budget as per-agent cost bound, exempt actors, operator runbook
agent-standards	Required files, compliance exemptions, AgentShield CI workflow, decision-making reusables, BMAD Method Workflows
ci-standards	Staged promotion through concentric rings, reusable workflow versioning (stable channel), action pinning policy, permissions policy, Dev-Lead Agent
codeowners-standard	Team composition, required setup for new bots, branch protection, verified end-to-end
copilot-instructions-standard	Canonical instruction files, adding a new language, required sections, content quality rules
dependabot-policy	Configuration files, auto-merge workflow, vulnerability audit CI check, applying to a repository
feature-ideation-sources	AI/ML vendor & lab sources, developer tooling changelogs, security & compliance sources, newsletters, podcasts
github-settings	Org-level settings, repository rulesets, required checks ruleset, GitHub Apps & integrations, org-level secrets
gitignore-standard	Two-Layer Model (L1 secrets baseline, L2 ecosystem extension), managed-block markers, negation discipline, compliance check
initiatives-project	Project board fields, Theme → Initiative, how auto-add works, initiative classification
persona-standards	Canary onboarding (the last step), trigger matrix, trust & permissions, definition of done
pr-limits	Exempt actors, operator runbook, reconciliation with the Dependabot cap
push-protection	Layer 1 (GitHub push protection), Layer 2 (local pre-commit), Layer 3 (CI secret scanning), incident response
ruleset-remediation-runbook	Bypass actors, migrate checks into code-quality, delete legacy rulesets, rollback procedure

Documentation

• Architecture & Capabilities
• Setup Guide
• Machine User Setup