Compliance audit — 2026-04-17

[don-petry]

Compliance Audit — 2026-04-17

This umbrella issue tracks all findings from the automated compliance audit run on 2026-04-17.
Findings are grouped by remediation category. Address each category together to avoid duplicate agent PRs.

Total findings: 83 across 7 repositories

---

Remediation Work Breakdown

Repository Settings (14 finding(s))

Remediation: apply-repo-settings.sh
Affected repos: .github, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	allow_auto_merge	warning
.github	delete_branch_on_merge	warning
ContentTwin	allow_auto_merge	warning
ContentTwin	delete_branch_on_merge	warning
markets	allow_auto_merge	warning
markets	delete_branch_on_merge	warning
google-app-scripts	allow_auto_merge	warning
google-app-scripts	delete_branch_on_merge	warning
broodly	allow_auto_merge	warning
broodly	delete_branch_on_merge	warning
bmad-bgreat-suite	allow_auto_merge	warning
bmad-bgreat-suite	delete_branch_on_merge	warning
TalkTerm	allow_auto_merge	warning
TalkTerm	delete_branch_on_merge	warning

Push Protection & Secret Scanning (16 finding(s))

Remediation: apply-repo-settings.sh (security_and_analysis) + per-repo ci.yml and .gitignore
Affected repos: .github, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	security_and_analysis_unavailable	warning
.github	secret_scan_ci_job_present	error
ContentTwin	security_and_analysis_unavailable	warning
ContentTwin	secret_scan_ci_job_present	error
markets	security_and_analysis_unavailable	warning
markets	secret_scan_ci_job_present	error
google-app-scripts	security_and_analysis_unavailable	warning
google-app-scripts	secret_scan_ci_job_present	error
google-app-scripts	gitignore_secrets_block	warning
broodly	security_and_analysis_unavailable	warning
broodly	secret_scan_ci_job_present	error
broodly	gitignore_secrets_block	warning
bmad-bgreat-suite	security_and_analysis_unavailable	warning
bmad-bgreat-suite	secret_scan_ci_job_present	error
bmad-bgreat-suite	gitignore_secrets_block	warning
TalkTerm	security_and_analysis_unavailable	warning

Repository Rulesets (2 finding(s))

Remediation: apply-rulesets.sh
Affected repos: ContentTwin, broodly

Repo	Check	Severity
ContentTwin	required-claude-check-broken	error
broodly	required-claude-check-broken	error

Workflows (14 finding(s))

Remediation: per-repo workflow additions
Affected repos: .github, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	codeql-default-setup-not-configured	error
ContentTwin	codeql-default-setup-not-configured	error
ContentTwin	stray-codeql-workflow	error
markets	codeql-default-setup-not-configured	error
markets	stray-codeql-workflow	error
google-app-scripts	codeql-default-setup-not-configured	error
google-app-scripts	stray-codeql-workflow	error
broodly	codeql-default-setup-not-configured	error
broodly	stray-codeql-workflow	error
bmad-bgreat-suite	codeql-default-setup-not-configured	error
bmad-bgreat-suite	stray-codeql-workflow	error
TalkTerm	missing-ci.yml	error
TalkTerm	codeql-default-setup-not-configured	error
TalkTerm	stray-codeql-workflow	error

Action SHA Pinning (36 finding(s))

Remediation: pin actions to SHA in each workflow file
Affected repos: .github, ContentTwin, TalkTerm, bmad-bgreat-suite, broodly, google-app-scripts, markets

Repo	Check	Severity
.github	unpinned-actions-agent-shield.yml	error
.github	unpinned-actions-claude.yml	error
.github	unpinned-actions-dependency-audit.yml	error
ContentTwin	unpinned-actions-agent-shield.yml	error
ContentTwin	unpinned-actions-claude.yml	error
ContentTwin	unpinned-actions-dependabot-automerge.yml	error
ContentTwin	unpinned-actions-dependabot-rebase.yml	error
ContentTwin	unpinned-actions-dependency-audit.yml	error
markets	unpinned-actions-agent-shield.yml	error
markets	unpinned-actions-claude.yml	error
markets	unpinned-actions-dependabot-automerge.yml	error
markets	unpinned-actions-dependabot-rebase.yml	error
markets	unpinned-actions-dependency-audit.yml	error
markets	unpinned-actions-feature-ideation.yml	error
google-app-scripts	unpinned-actions-agent-shield.yml	error
google-app-scripts	unpinned-actions-claude.yml	error
google-app-scripts	unpinned-actions-dependabot-automerge.yml	error
google-app-scripts	unpinned-actions-dependabot-rebase.yml	error
google-app-scripts	unpinned-actions-dependency-audit.yml	error
google-app-scripts	unpinned-actions-feature-ideation.yml	error
broodly	unpinned-actions-agent-shield.yml	error
broodly	unpinned-actions-claude.yml	error
broodly	unpinned-actions-dependabot-automerge.yml	error
broodly	unpinned-actions-dependabot-rebase.yml	error
broodly	unpinned-actions-dependency-audit.yml	error
broodly	unpinned-actions-feature-ideation.yml	error
bmad-bgreat-suite	unpinned-actions-agent-shield.yml	error
bmad-bgreat-suite	unpinned-actions-claude.yml	error
bmad-bgreat-suite	unpinned-actions-dependabot-automerge.yml	error
bmad-bgreat-suite	unpinned-actions-dependency-audit.yml	error
TalkTerm	unpinned-actions-agent-shield.yml	error
TalkTerm	unpinned-actions-claude.yml	error
TalkTerm	unpinned-actions-dependabot-automerge.yml	error
TalkTerm	unpinned-actions-dependabot-rebase.yml	error
TalkTerm	unpinned-actions-dependency-audit.yml	error
TalkTerm	unpinned-actions-feature-ideation.yml	error

Dependabot Configuration (1 finding(s))

Remediation: per-repo .github/dependabot.yml
Affected repos: google-app-scripts

Repo	Check	Severity
google-app-scripts	wrong-limit-npm	warning

---

Generated by the weekly compliance audit on 2026-04-17 13:37 UTC.
Address each remediation category as a single coordinated PR to avoid duplicate agent work.

[don-petry]

Claude finished @don-petry's task in 8m 30s —— View job • claude/issue-146-20260417-1337 • [Create PR ➔](https://github.com/petry-projects/.github/compare/main...claude/issue-146-20260417-1337?quick_pull=1&title=Issue%20%23146%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23146%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

---

Fixing compliance findings for .github repo

Waiting for CI on PR #147.

SHA Pinning (3 findings)

• Read CI standards and look up action SHAs
• Pin claude.yml reusable workflow reference (@main → ae9709f... = v1)
• Pin agent-shield.yml reusable workflow reference (@v1 tag → SHA)
• Replace dependency-audit.yml with thin stub template (SHA-pinned) — eliminates dtolnay/rust-toolchain@stable

Secret Scan CI job (1 finding)

• Add secret-scan job to ci.yml using gitleaks/gitleaks-action@ff98106... (v2.3.9)

API-Applied Settings (3 findings)

• Enable CodeQL default setup ✅ (triggered run #24189208962)
• Set allow_auto_merge=true ✅
• Set delete_branch_on_merge=true ✅

PR & Review

• Commit and push
• PR #147 created
• CI passes
• Tag code owner for review

Note: security_and_analysis_unavailable warnings require GitHub Advanced Security (org plan upgrade) — not actionable at workflow level.

[don-petry]

Resolved! This check is now passing as of 2026-04-21. Closing automatically.