Skip to content

Compliance: missing-agent-shield.yml #122

New issue
New issue
Closed
#146
Closed
Compliance: missing-agent-shield.yml#122
#146
Labels
compliance-auditAutomated compliance audit finding

Description

@don-petry
don-petry
opened on Apr 6, 2026

Compliance Finding

Category: ci-workflows
Severity: error
Check: missing-agent-shield.yml

Detail

Required workflow agent-shield.yml is missing

Standard Reference

standards/ci-standards.md#required-workflows

Remediation

Please review the linked standard and bring this repository into compliance.

See the full standards documentation for implementation guidance.

This issue was automatically created by the weekly compliance audit.

Activity

  1. don-petry
    added
    compliance-auditAutomated compliance audit finding
    claude
    on Apr 6, 2026

  2. claude commented on Apr 6, 2026

    @claude
    claudeBot
    on Apr 6, 2026 – with Claude

    Claude finished @don-petry's task in 1m 28s —— View job

    Tasks

    • Gather context and understand the issue
    • Review existing workflows in the repository
    • Attempt to create agent-shield.yml

    Analysis

    I've reviewed the existing workflows in .github/workflows/:

    • ci.yml, coverage.yml, codeql-analysis.yml, playwright-tests.yml
    • dependabot-rebase.yml, sonarcloud.yml, nodejs-tests.yml
    • dependabot-automerge.yml, claude.yml

    Limitation: I'm unable to create or modify files in the .github/workflows/ directory. GitHub App permissions restrict workflow file modifications for security reasons.

    To add the required agent-shield.yml workflow, you'll need to manually create it. Please review the standard reference for the exact workflow definition, then add .github/workflows/agent-shield.yml to this repository.

    You can find more information and potential workarounds in the FAQ.

  3. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Required workflow agent-shield.yml is missing

    Standard: standards/ci-standards.md#required-workflows

  4. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Required workflow agent-shield.yml is missing

    Standard: standards/ci-standards.md#required-workflows

  5. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Required workflow agent-shield.yml is missing

    Standard: standards/ci-standards.md#required-workflows

  6. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    CollaboratorAuthor

    Weekly Compliance Audit (2026-04-06)

    This finding is still open.

    Detail: Required workflow agent-shield.yml is missing

    Standard: standards/ci-standards.md#required-workflows

  7. don-petry
    added
    claude
    and removed
    claude
    on Apr 6, 2026

  8. don-petry commented on Apr 6, 2026

    @don-petry
    don-petry
    on Apr 6, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 13m 51s —— View job

    Tasks

    • Gather context and understand the issue
    • Review existing workflows in the repository
    • Create agent-shield.yml workflow (committed locally, following claude.yml thin-caller pattern)
    • Attempt to push changes — blocked: token lacks workflows scope
    • Push changes and create pull request

    Status

    I've created .github/workflows/agent-shield.yml following the exact same thin-caller pattern as claude.yml, with a local commit ready to push. However, the push is failing because the current authentication token doesn't have the Workflows: Read and write repository permission:

    refusing to allow a GitHub App to create or update workflow
`.github/workflows/agent-shield.yml` without `workflows` permission

    Workflow created

    The file follows the same pattern as claude.yml (thin caller delegating to the org-level reusable workflow):

    # Agent Shield — thin caller that delegates to the org-level reusable workflow.
# All logic is maintained centrally in agent-shield-reusable.yml.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#required-workflows
name: Agent Shield

on:
  pull_request:
    branches: [main]
    types: [opened, reopened, synchronize]
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, edited, labeled]

permissions: {}

jobs:
  agent-shield:
    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@main
    secrets: inherit
    permissions:
      contents: read
      pull-requests: read
      issues: read

    Next steps

    To complete this fix, one of the following is needed:

    1. Configure GH_PAT_WORKFLOWS secret — Create a classic PAT with workflow scope (or a fine-grained PAT with Workflows: Read and write permission) and store it as an org/repo secret named GH_PAT_WORKFLOWS. This is what PR feat: switch to org-level reusable Claude Code workflow #134 intended to set up. Once configured, re-trigger this issue with the claude label.

    2. Manual push — The commit is already staged locally. You can push it manually:

      git push origin claude/issue-122-20260406-1848

      Then create a PR

  9. don-petry
    added
    claude
    and removed
    claude
    on Apr 7, 2026

  10. don-petry commented on Apr 7, 2026

    @don-petry
    don-petry
    on Apr 7, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 1m 33s —— View job • Create PR ➔

    Tasks

    • Gather context and understand the issue
    • Review standard reference and existing claude.yml pattern
    • Create agent-shield.yml workflow
    • Commit changes (local commit 63c56a1 ready)
    • Attempt push — blocked: token lacks workflows scope

    Status

    I've created .github/workflows/agent-shield.yml following the thin-caller pattern (same as claude.yml) and committed it locally. However, the push is blocked by GitHub's security restriction — the GitHub App token cannot create or modify workflow files without the workflows permission:

    refusing to allow a GitHub App to create or update workflow
`.github/workflows/agent-shield.yml` without `workflows` permission

    This is the same limitation encountered in the previous two attempts.

    Workflow created

    # Agent Shield — thin caller that delegates to the org-level reusable workflow.
# All logic is maintained centrally in agent-shield-reusable.yml.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#required-workflows
name: Agent Shield

on:
  pull_request:
    branches: [main]
    types: [opened, reopened, synchronize]
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, edited, labeled]

permissions: {}

jobs:
  agent-shield:
    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@main
    secrets: inherit
    permissions:
      contents: read
      pull-requests: read
      issues: read

    Resolution required

    To unblock this, one of the following is needed:

    Option 1 — Configure a PAT secret (recommended)

    Create a classic PAT with the workflow scope (or a fine-grained PAT with Workflows: Read and write permission) and store it as a repo/org secret named GH_PAT_WORKFLOWS. Once configured, re-trigger with the claude label.

    Option 2 — Manual push

    The commit 63c56a1 is staged on branch claude/issue-122-20260407-0239. Push it manually:

    git push origin claude/issue-122-20260407-0239

    Then

    See the FAQ for more details on this limitation.

  11. don-petry
    added
    claude
    and removed
    claude
    on Apr 7, 2026

  12. don-petry commented on Apr 7, 2026

    @don-petry
    don-petry
    on Apr 7, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 1m 20s —— View job • Create PR ➔

    Tasks

    • Gather context and understand the issue
    • Review existing claude.yml pattern
    • Create agent-shield.yml workflow (commit 0144d51 ready locally)
    • Attempt push — blocked: token lacks workflows scope
    • Push changes (requires GH_PAT_WORKFLOWS secret)

    Status

    I've created .github/workflows/agent-shield.yml following the same thin-caller pattern as claude.yml and committed it locally. However, the push is blocked by GitHub's security restriction — the GitHub App token cannot create or modify workflow files without the workflows permission:

    refusing to allow a GitHub App to create or update workflow
`.github/workflows/agent-shield.yml` without `workflows` permission

    This is the same limitation encountered in all previous attempts on this issue.

    Workflow created

    # Agent Shield — thin caller that delegates to the org-level reusable workflow.
# All logic is maintained centrally in agent-shield-reusable.yml.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#required-workflows
name: Agent Shield

on:
  pull_request:
    branches: [main]
    types: [opened, reopened, synchronize]
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, edited, labeled]

permissions: {}

jobs:
  agent-shield:
    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@main
    secrets: inherit
    permissions:
      contents: read
      pull-requests: read
      issues: read

    Resolution required

    This issue cannot be resolved by re-triggering Claude — the constraint is a GitHub App permission limitation that requires a one-time setup:

    Option 1 — Configure a PAT secret (recommended)

    1. Create a classic PAT with the workflow scope (or a fine-grained PAT with Workflows: Read and write permission)
    2. Store it as a repo/org secret named GH_PAT_WORKFLOWS
    3. Once configured, re-trigger with the claude label

    Option 2 — Manual push

    The commit 0144d51 is staged on branch claude/issue-122-20260407-1134. Push it manually:

    git fetch origin claude/issue-122-20260407-1134
git push origin claude/issue-122-20260407-1134

    Then

    See the FAQ for more details on this limitation.

  13. don-petry
    added
    claude
    and removed
    claude
    on Apr 7, 2026

  14. don-petry commented on Apr 7, 2026

    @don-petry
    don-petry
    on Apr 7, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 2m 19s —— View job • Create PR ➔

    Tasks

    • Gather context and understand the issue
    • Review existing claude.yml pattern
    • Create agent-shield.yml workflow (commit 55fabfd ready locally)
    • Attempt push — blocked: token lacks workflows scope
    • Push changes (requires GH_PAT_WORKFLOWS secret or manual push)

    Status

    I've created .github/workflows/agent-shield.yml following the exact same thin-caller pattern as claude.yml, and committed it locally as 55fabfd. However, the push is blocked by GitHub's security restriction — the GitHub App token cannot create or modify workflow files without the workflows permission:

    refusing to allow a GitHub App to create or update workflow
`.github/workflows/agent-shield.yml` without `workflows` permission

    This is the same limitation encountered in all previous attempts on this issue. Re-triggering Claude will not resolve it — the constraint requires a one-time setup.

    Workflow created

    # Agent Shield — thin caller that delegates to the org-level reusable workflow.
# All logic is maintained centrally in agent-shield-reusable.yml.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#required-workflows
name: Agent Shield

on:
  pull_request:
    branches: [main]
    types: [opened, reopened, synchronize]
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, edited, labeled]

permissions: {}

jobs:
  agent-shield:
    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@main
    secrets: inherit
    permissions:
      contents: read
      pull-requests: read
      issues: read

    Resolution required

    Option 1 — Configure a PAT secret (recommended)

    1. Create a classic PAT with the workflow scope (or a fine-grained PAT with Workflows: Read and write permission)
    2. Store it as a repo/org secret named GH_PAT_WORKFLOWS
    3. Once configured, re-trigger with the claude label

    Option 2 — Manual push

    The commit 55fabfd is staged on branch claude/issue-122-20260407-1201. To complete this manually:

    git fetch origin claude/issue-122-20260407-1201
git push origin claude/issue-122-20260407-1201

    Then

    See the FAQ for more details on this limitation.

  15. don-petry
    added
    claude
    and removed
    claude
    on Apr 7, 2026

  16. don-petry commented on Apr 7, 2026

    @don-petry
    don-petry
    on Apr 7, 2026
    CollaboratorAuthor

    Claude finished @don-petry's task in 4m 53s —— View job • claude/issue-122-20260407-1722 • [Create PR ➔](https://github.com/petry-projects/google-app-scripts/compare/main...claude/issue-122-20260407-1722?quick_pull=1&title=Issue%20%23122%3A%20Changes%20from%20Claude&body=This%20PR%20addresses%20issue%20%23122%0A%0AGenerated%20with%20%5BClaude%20Code%5D(https%3A%2F%2Fclaude.ai%2Fcode)

    Tasks

    • Gather context and understand the issue
    • Review existing claude.yml pattern
    • Create agent-shield.yml workflow (commit 5cfd766)
    • Push changes to claude/issue-122-20260407-1722
    • Create pull request — #146
    • Verify CI and review results

    Summary

    Successfully created and pushed .github/workflows/agent-shield.yml as a thin-caller following the same pattern as claude.yml, delegating to the org-level reusable workflow.

    CI Status:

    • ✅ All core checks pass (build-and-test, Node.js Tests, coverage, CodeQL, Playwright UI Tests, SonarCloud workflow)
    • ⚠️ autofix fails — pre-existing formatting issue in feature-ideation.yml (from main, not introduced by this PR); the autofix job lacks workflows permission to push the fix
    • ⚠️ SonarCloud Code Analysis fails — pre-existing quality gate issue, no JS/TS was modified

    Tagged @don-petry on the PR for review and merge.
    • View PR #146

  17. don-petry
    added a commit that references this issue on Apr 7, 2026

    feat(ci): add required agent-shield.yml workflow

    5cfd766
  18. don-petry
    closed this as completedin #146on Apr 7, 2026
  19. don-petry
    added a commit that references this issue on Apr 7, 2026

    feat(ci): add required agent-shield.yml workflow (#146)

    1620841
  20. don-petry
    added a commit that references this issue on Aug 4, 2026

    feat(ci): add required agent-shield.yml workflow (#146)

    3605dbe
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    compliance-auditAutomated compliance audit finding

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions