feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns by don-petry · Pull Request #294 · petry-projects/broodly

don-petry · 2026-06-08T01:03:04Z

Closes #262

Implemented by dev-lead agent. Please review.

Summary by CodeRabbit

Chores
- Updated GitHub repository security configuration settings to ensure proper organization and consistency of security scanning options.

…_patterns

coderabbitai · 2026-06-08T01:03:11Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fbe6c7cd-b48f-4f69-b453-dfe4cfa7f7ca

📥 Commits

Reviewing files that changed from the base of the PR and between 6dfb7bc and 4e8c58c.

📒 Files selected for processing (1)

.github/settings.yml

📝 Walkthrough

Walkthrough

The .github/settings.yml file has its security_and_analysis block corrected: secret_scanning_ai_detection and secret_scanning_non_provider_patterns entries, previously misaligned outside the block, are re-indented alongside the other secret_scanning* and dependabot_security_updates settings under repository.security_and_analysis.

Changes

settings.yml security_and_analysis YAML fix

Layer / File(s)	Summary
Fix security_and_analysis nesting `.github/settings.yml`	Re-indents `secret_scanning_ai_detection` and `secret_scanning_non_provider_patterns` into `repository.security_and_analysis`, making all five security sub-keys consistently nested under that block.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly references issue `#262` and mentions secret_scanning_non_provider_patterns, which aligns with the primary change of enabling this compliance requirement in the repository settings.
Linked Issues check	✅ Passed	The PR successfully enables secret_scanning_non_provider_patterns by nesting it under repository.security_and_analysis in .github/settings.yml, directly addressing the compliance requirement to transition from disabled to enabled state.
Out of Scope Changes check	✅ Passed	All changes are within scope, consisting only of YAML configuration adjustments to enable secret scanning features and fix their placement under the correct security_and_analysis block.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch dev-lead/issue-262-20260608-0100

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request restructures the .github/settings.yml file by moving the secret_scanning_ai_detection and secret_scanning_non_provider_patterns configurations from the repository block to the top-level security_and_analysis block. The reviewer suggested explicitly enabling the base secret_scanning and secret_scanning_push_protection settings alongside these advanced features to ensure core scanning capabilities and push protection are active.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 624a6b2c20

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

chatgpt-codex-connector · 2026-06-15T23:36:42Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

chatgpt-codex-connector · 2026-06-15T23:42:50Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

chatgpt-codex-connector · 2026-06-15T23:51:07Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

chatgpt-codex-connector · 2026-06-15T23:59:19Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

chatgpt-codex-connector · 2026-06-16T00:05:17Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

chatgpt-codex-connector · 2026-06-18T01:47:09Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

don-petry · 2026-06-18T01:58:08Z

Dev-Lead — review-changes (applied)

Changes committed and pushed.

chatgpt-codex-connector · 2026-06-18T01:58:11Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

don-petry · 2026-06-18T02:05:12Z

Dev-Lead — fix-bot-comment (applied)

Changes committed and pushed.

chatgpt-codex-connector · 2026-06-18T02:05:16Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

don-petry · 2026-06-18T02:09:15Z

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

don-petry · 2026-06-18T02:11:50Z

Dev-Lead — fix-bot-comment (no-changes)

Agent reasoning

Issues addressed: 0
Files changed: None
Status: Quality Gate passed — no changes required
```

chatgpt-codex-connector · 2026-06-18T05:08:20Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

sonarqubecloud · 2026-06-18T05:10:34Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

don-petry · 2026-06-18T05:12:57Z

Dev-Lead — review-changes (no-changes)

No changes were needed for this PR.

donpetry-bot

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 4e8c58c8893da460d178a8a7e48255c3971286ae
Review mode: triage-approved (single reviewer)

Summary

Fixes the security_and_analysis block in .github/settings.yml (Probot Settings format). The block was previously misplaced at the top level as a sibling of 'repository:', where the Settings app would ignore it; this PR re-nests it under repository.security_and_analysis and consolidates all five security sub-keys there. It also explicitly enables the base secret_scanning and secret_scanning_push_protection alongside the advanced secret_scanning_ai_detection and secret_scanning_non_provider_patterns, plus dependabot_security_updates. Trivial, declarative, security-positive change (+6/-4, one file).

Linked issue analysis

Closes #262, a compliance audit finding requiring secret_scanning_non_provider_patterns to be enabled per the org push-protection standard. The PR substantively addresses this: the setting is now correctly nested under repository.security_and_analysis (rather than an ignored top-level block) and set to enabled. It also incorporates the earlier gemini-code-assist suggestion to explicitly enable the base secret_scanning and secret_scanning_push_protection that the advanced features depend on.

Findings

No issues found.

Indentation/nesting fix is correct for the Probot Settings schema; the formerly top-level security_and_analysis block (which had no effect) is removed and merged into repository.security_and_analysis.
All five security sub-keys are now consistently nested and enabled.
No code paths, secrets, or credentials are touched; the change only strengthens repo security posture.
Advisory bots: CodeRabbit reported no actionable comments; SonarCloud Quality Gate passed (0 new issues); Codex comments are usage-limit notices only, not findings.

CI status

All required checks green. SUCCESS: CI (TypeScript, Go, Secret scan/gitleaks), CodeQL (actions, go, javascript-typescript), AgentShield, SonarCloud, Dependency audit, CodeRabbit, dev-lead, pr-auto-review. SKIPPED: dependabot-automerge, push image, and non-applicable ecosystem audits. No failing checks. mergeStateStatus is BLOCKED only pending the required org-leads review this verdict feeds.

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

donpetry-bot

Automated review — APPROVED ✓

Risk: LOW
Reviewed commit: 4e8c58c8893da460d178a8a7e48255c3971286ae
Review mode: triage-approved (single reviewer)

Summary

Trivial config-only fix to .github/settings.yml: re-nests the security_and_analysis block under repository (where probot/settings expects it) and enables the full set of secret-scanning settings. Security-hardening change, all CI green, all reviewer feedback resolved.

Linked issue analysis

Closes #262, a compliance finding requiring secret_scanning_non_provider_patterns to be enabled. The PR enables it (status: enabled) and correctly nests it under repository.security_and_analysis. Directly and substantively addresses the issue.

Findings

The diff fixes a real bug: dependabot_security_updates was previously at the top level, outside repository:, where probot/settings would not apply it. It is now correctly nested.
Net-new keys secret_scanning and secret_scanning_push_protection are added (enabled). In-scope hardening, consistent with the compliance theme and explicitly requested by bot reviewers.
Verified the resulting file parses as valid YAML with a single repository.security_and_analysis block containing all five settings; no duplicate/orphaned keys remain.
Bot reviewer concerns (gemini: enable base scanning + push protection; codex: keep block under repository) were both addressed by the author; no unanswered human-reviewer questions.
No blocking issues.

CI status

All checks complete and green. Relevant security checks SUCCESS: CodeQL, Secret scan (gitleaks), SonarCloud, AgentShield, Analyze (actions/go/javascript-typescript), dependency-audit (pnpm/govulncheck), TypeScript, Go, CodeRabbit. No failures; remaining checks SKIPPED as expected for this change.

Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.

…_patterns (#294) * feat: implement issue #262 — Compliance: secret_scanning_non_provider_patterns * chore: apply manual instructions [skip ci-relay] * fix(bot): address bot feedback [skip ci-relay] --------- Co-authored-by: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com>

feat: implement issue #262 — Compliance: secret_scanning_non_provider…

624a6b2

…_patterns

don-petry requested a review from a team as a code owner June 8, 2026 01:03

Copilot AI review requested due to automatic review settings June 8, 2026 01:03

Copilot started reviewing on behalf of don-petry June 8, 2026 01:03 View session

gemini-code-assist Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread .github/settings.yml Outdated

chatgpt-codex-connector Bot reviewed Jun 8, 2026

View reviewed changes

Comment thread .github/settings.yml Outdated

Copilot AI reviewed Jun 8, 2026

don-petry mentioned this pull request Jun 8, 2026

Org Status — 2026-06-08 petry-projects/.github#419

Closed

Merge branch 'main' into dev-lead/issue-262-20260608-0100

c72a5b6

Merge branch 'main' into dev-lead/issue-262-20260608-0100

ff5d8b9

Merge branch 'main' into dev-lead/issue-262-20260608-0100

70902e0

Merge branch 'main' into dev-lead/issue-262-20260608-0100

1e6a70c

Merge branch 'main' into dev-lead/issue-262-20260608-0100

7d7b8e2

Merge branch 'main' into dev-lead/issue-262-20260608-0100

e07d919

This was referenced Jun 16, 2026

Org Status — 2026-06-16 petry-projects/.github#470

Open

Org Status — 2026-06-17 petry-projects/.github#476

Open

Merge branch 'main' into dev-lead/issue-262-20260608-0100

2b49862

chore: apply manual instructions [skip ci-relay]

381e3cf

don-petry enabled auto-merge (squash) June 18, 2026 01:58

don-petry disabled auto-merge June 18, 2026 02:03

fix(bot): address bot feedback [skip ci-relay]

52b4ba3

don-petry enabled auto-merge (squash) June 18, 2026 02:05

don-petry disabled auto-merge June 18, 2026 02:08

don-petry enabled auto-merge (squash) June 18, 2026 02:09

don-petry disabled auto-merge June 18, 2026 02:11

don-petry enabled auto-merge (squash) June 18, 2026 02:11

Merge branch 'main' into dev-lead/issue-262-20260608-0100

4e8c58c

don-petry disabled auto-merge June 18, 2026 05:11

don-petry enabled auto-merge (squash) June 18, 2026 05:13

donpetry-bot approved these changes Jun 18, 2026

View reviewed changes

don-petry merged commit 4df17ae into main Jun 18, 2026
23 checks passed

don-petry deleted the dev-lead/issue-262-20260608-0100 branch June 18, 2026 05:17

donpetry-bot approved these changes Jun 18, 2026

View reviewed changes

Conversation

don-petry commented Jun 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jun 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Jun 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 18, 2026

Uh oh!

don-petry commented Jun 18, 2026

Dev-Lead — review-changes (applied)

Uh oh!

chatgpt-codex-connector Bot commented Jun 18, 2026

Uh oh!

don-petry commented Jun 18, 2026

Dev-Lead — fix-bot-comment (applied)

Uh oh!

chatgpt-codex-connector Bot commented Jun 18, 2026

Uh oh!

don-petry commented Jun 18, 2026

Dev-Lead — review-changes (no-changes)

Uh oh!

don-petry commented Jun 18, 2026

Dev-Lead — fix-bot-comment (no-changes)

Uh oh!

chatgpt-codex-connector Bot commented Jun 18, 2026

Uh oh!

sonarqubecloud Bot commented Jun 18, 2026

Quality Gate passed

Uh oh!

don-petry commented Jun 18, 2026

Dev-Lead — review-changes (no-changes)

Uh oh!

donpetry-bot left a comment

Choose a reason for hiding this comment

Automated review — APPROVED ✓

Summary

Linked issue analysis

Findings

CI status

Uh oh!

Uh oh!

donpetry-bot left a comment

Choose a reason for hiding this comment

Automated review — APPROVED ✓

Summary

Linked issue analysis

Findings

CI status

Uh oh!

Reviewers

Assignees

Labels

don-petry commented Jun 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jun 8, 2026 •

edited

Loading