🚨 Compliance Check [1 critical, 4 high, 4 med, 3 low]

Compliance Check Results

Score: 51% - 🟠 Needs Improvement
Passed: 6 checks
Failed: 12 checks (1 critical, 4 high, 4 medium, 3 low)

---

❌ Failed Checks

COMP-009 - ADR Pattern

• Priority: MEDIUM
• Message: ADR directory not found (docs/adr/)

COMP-020 - ARC Runner Usage

• Priority: MEDIUM
• Message: 1 of 1 job(s) not using ARC runner: repo-info.yml uses GitHub-hosted runner: ubuntu-latest

COMP-016 - Branch Protection

• Priority: HIGH
• Message: Branch 'main' is not protected

COMP-010 - .claude/ Configuration

• Priority: MEDIUM
• Message: .claude/ directory not found

COMP-011 - CONTRIBUTING.md

• Priority: LOW
• Message: CONTRIBUTING.md not found

COMP-015 - Deprecated Actions

• Priority: HIGH
• Message: Found 1 deprecated action(s): actions/checkout@v3 in repo-info.yml

COMP-006 - docs/ Directory

• Priority: HIGH
• Message: docs/ directory exists but missing README.md

COMP-008 - Issue Templates

• Priority: MEDIUM
• Message: No issue templates found (.github/ISSUE_TEMPLATE/ not found)

COMP-002 - LICENSE File Exists

• Priority: CRITICAL
• Message: LICENSE file not found (checked LICENSE, LICENSE.md, LICENSE.txt, LICENCE)

COMP-013 - MkDocs Configuration

• Priority: LOW
• Message: mkdocs.yml not found

COMP-017 - Repository Settings

• Priority: HIGH
• Message: Repository settings issues: No merge methods enabled

COMP-012 - SECURITY.md

• Priority: LOW
• Message: SECURITY.md not found

---

✅ Passed Checks

• COMP-019: Branch Rulesets (not Classic Protection)
• COMP-004: CLAUDE.md Exists
• COMP-018: Default Branch
• COMP-003: .gitignore Exists
• COMP-001: README.md Exists
• COMP-005: README Structure

---

Generated: 2026-05-11 10:22:26 UTC
Workflow Run: https://github.com/labrats-work/labrats-compliance/actions/runs/25664316713

[labrats-compliance-bot]

🤖 Automated Fix Suggestions

The following suggestions were generated by Claude based on the compliance framework documentation.

---

Compliance Fix Instructions for .github Repository

This repository has 16 failed compliance checks. Below are step-by-step instructions to fix each issue, organized by priority.

---

Summary

Priority	Failed Checks	Action Required
CRITICAL	4	Immediate action needed
HIGH	5	Should be addressed soon
MEDIUM	4	Recommended improvements
LOW	3	Nice to have

---

CRITICAL Priority Fixes

COMP-001: README.md Exists

What it checks: Verifies that a README.md file exists in the repository root.

Fix: Create README.md in the repository root:

cat > README.md << 'EOF'
# .github

Organization-wide GitHub configuration and shared workflows.

## Purpose

This repository contains default community health files and reusable workflows for the organization.

## Quick Start

Files in this repository are automatically inherited by other repositories in the organization that don't have their own versions.

## Structure

.github/
├── .github/
│ └── workflows/ # Workflows for this repo
├── workflow-templates/ # Reusable workflow templates
├── ISSUE_TEMPLATE/ # Default issue templates
└── profile/ # Organization profile

## Contributing

See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
EOF

---

COMP-002: LICENSE File Exists

What it checks: Verifies that a LICENSE file exists (LICENSE, LICENSE.md, LICENSE.txt, or LICENCE).

Fix: Create LICENSE file with MIT license:

cat > LICENSE << 'EOF'
MIT License

Copyright (c) 2024 [Your Name/Organization]

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
EOF

---

COMP-003: .gitignore Exists

What it checks: Verifies that a non-empty .gitignore file exists.

Fix: Create .gitignore:

cat > .gitignore << 'EOF'
# OS files
.DS_Store
Thumbs.db

# Editor files
*.swp
*.swo
*~
.idea/
.vscode/

# Logs
*.log

# Environment files
.env
.env.local

# Temporary files
tmp/
temp/
EOF

---

COMP-004: CLAUDE.md Exists

What it checks: Verifies that CLAUDE.md exists with meaningful content (more than 5 lines).

Fix: Create CLAUDE.md:

cat > CLAUDE.md << 'EOF'
# CLAUDE.md - AI Assistant Context

## Repository Overview

This is the `.github` repository containing organization-wide GitHub configurations, default community health files, and reusable workflow templates.

## Key Files and Directories

- `workflow-templates/` - Reusable GitHub Actions workflow templates
- `ISSUE_TEMPLATE/` - Default issue templates for all repositories
- `profile/README.md` - Organization profile displayed on GitHub
- `.github/workflows/` - Workflows specific to this repository

## Common Tasks

### Adding a New Workflow Template

1. Create the workflow file in `workflow-templates/`
2. Create a matching `.properties.json` file with metadata
3. Test the workflow in a target repository

### Updating Issue Templates

1. Edit files in `ISSUE_TEMPLATE/`
2. Use YAML frontmatter for form-based templates

## Guidelines

- All workflows should use the ARC runner: `k8s-local-tomp736`
- Keep actions up to date (avoid deprecated versions)
- Follow the existing naming conventions
EOF

---

HIGH Priority Fixes

COMP-005: README Structure

What it checks: README.md must contain sections: Purpose, Quick Start, Structure.

Fix: Already addressed above - the README.md template includes all required sections.

---

COMP-006: docs/ Directory

What it checks: Verifies that docs/ directory exists with a README.md inside.

Fix: Create the docs directory structure:

mkdir -p docs

cat > docs/README.md << 'EOF'
# Documentation

This directory contains documentation for the organization's GitHub configuration.

## Contents

- [Workflow Templates](workflow-templates.md) - How to use shared workflow templates
- [Issue Templates](issue-templates.md) - Available issue templates

## Quick Links

- [GitHub Docs: Creating a default community health file](https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file)
EOF

---

COMP-015: Deprecated Actions

What it checks: Scans workflow files for deprecated GitHub Actions versions.

Issue: actions/checkout@v3 in repo-info.yml

Fix: Update to the latest version in .github/workflows/repo-info.yml:

# Find and replace the deprecated action
sed -i 's/actions\/checkout@v3/actions\/checkout@v4/g' .github/workflows/repo-info.yml

Or manually edit the file and change:

# Before
- uses: actions/checkout@v3

# After
- uses: actions/checkout@v4

---

COMP-016: Branch Protection

What it checks: Verifies that the main branch has protection rules enabled.

Fix: Enable branch protection via GitHub CLI:

# Create a branch ruleset (recommended for organizations)
gh api repos/{owner}/.github/rulesets \
  --method POST \
  -f name="main-protection" \
  -f target="branch" \
  -f enforcement="active" \
  -f "conditions[ref_name][include][]=refs/heads/main" \
  -f "rules[][type]=pull_request" \
  -f "rules[][parameters][required_approving_review_count]=1"

Or via GitHub UI:

1. Go to Settings → Branches
2. Click Add branch protection rule
3. Set Branch name pattern: main
4. Enable: Require a pull request before merging
5. Click Create

---

COMP-017: Repository Settings

What it checks: Validates repository settings including merge methods.

Issue: No merge methods enabled.

Fix: Enable at least one merge method via GitHub CLI:

# Enable squash merge (recommended)
gh repo edit --enable-squash-merge

# Or enable all merge methods
gh repo edit --enable-squash-merge --enable-merge-commit --enable-rebase-merge

Or via GitHub UI:

1. Go to Settings → General
2. Scroll to Pull Requests
3. Check at least one of: "Allow merge commits", "Allow squash merging", "Allow rebase merging"

---

MEDIUM Priority Fixes

COMP-008: Issue Templates

What it checks: Verifies that issue templates exist in .github/ISSUE_TEMPLATE/.

Fix: Create issue templates:

mkdir -p .github/ISSUE_TEMPLATE

cat > .github/ISSUE_TEMPLATE/bug_report.md << 'EOF'
---
name: Bug Report
about: Report a bug or issue
title: '[BUG] '
labels: bug
assignees: ''
---

## Description
A clear description of the bug.

## Steps to Reproduce
1. 
2. 
3. 

## Expected Behavior


## Actual Behavior


## Environment
- OS: 
- Version: 
EOF

cat > .github/ISSUE_TEMPLATE/feature_request.md << 'EOF'
---
name: Feature Request
about: Suggest a new feature or improvement
title: '[FEATURE] '
labels: enhancement
assignees: ''
---

## Description
A clear description of the feature.

## Use Case
Why is this feature needed?

## Proposed Solution
How should this work?
EOF

---

COMP-009: ADR Pattern

What it checks: Verifies that docs/adr/ directory exists with ADR files.

Fix: Create ADR directory and initial record:

mkdir -p docs/adr

cat > docs/adr/INDEX.md << 'EOF'
# Architecture Decision Records

This directory contains Architecture Decision Records (ADRs) for this repository.

## Records

| ID | Title | Status | Date |
|----|-------|--------|------|
| [0001](0001-use-adr-pattern.md) | Use ADR Pattern | Accepted | 2024-01-01 |
EOF

cat > docs/adr/0001-use-adr-pattern.md << 'EOF'
# 1. Use ADR Pattern for Architecture Decisions

Date: 2024-01-01

## Status

Accepted

## Context

We need a way to document important architecture decisions.

## Decision

We will use Architecture Decision Records (ADRs) following the format described by Michael Nygard.

## Consequences

- Decisions are documented and discoverable
- New team members can understand historical context
- Changes to decisions are tracked over time
EOF

---

COMP-010: .claude/ Configuration

What it checks: Verifies that .claude/ directory exists with configuration files.

Fix: Create the .claude directory:

mkdir -p .claude

cat > .claude/config.json << 'EOF'
{
  "version": "1.0",
  "context": {
    "include": ["CLAUDE.md", "README.md", "docs/"]
  }
}
EOF

---

COMP-020: ARC Runner Usage

What it checks: Verifies workflows use ARC runner (k8s-local-tomp736) instead of GitHub-hosted runners.

Issue: repo-info.yml uses ubuntu-latest

Fix: Update .github/workflows/repo-info.yml:

# Before
runs-on: ubuntu-latest

# After
runs-on: k8s-local-tomp736

---

LOW Priority Fixes

COMP-011: CONTRIBUTING.md

Fix: Create CONTRIBUTING.md:

cat > CONTRIBUTING.md << 'EOF'
# Contributing Guidelines

Thank you for your interest in contributing!

## How to Contribute

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Submit a pull request

## Code of Conduct

Please be respectful and constructive in all interactions.
EOF

---

COMP-012: SECURITY.md

Fix: Create SECURITY.md:

cat > SECURITY.md << 'EOF'
# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability, please report it by emailing [security@example.com].

Please do not open public issues for security vulnerabilities.

## Supported Versions

| Version | Supported |
|---------|-----------|
| Latest  | ✅        |
EOF

---

COMP-013: MkDocs Configuration

Fix: Create mkdocs.yml:

cat > mkdocs.yml << 'EOF'
site_name: .github Documentation
site_description: Organization GitHub configuration documentation
docs_dir: docs

theme:
  name: material

nav:
  - Home: README.md
EOF

---

Quick Fix Script

Run this script to apply all fixes at once:

#!/bin/bash
# quick-fix-compliance.sh

set -e

echo "Creating CRITICAL files..."
# Add the file creation commands from above

echo "Creating HIGH priority items..."
# Add the commands from above

echo "Creating MEDIUM priority items..."
# Add the commands from above

echo "Creating LOW priority items..."
# Add the commands from above

echo "Committing changes..."
git add -A
git commit -m "fix: resolve compliance check failures

- Add README.md, LICENSE, .gitignore, CLAUDE.md (CRITICAL)
- Add docs/ directory and structure (HIGH)
- Update deprecated actions to v4 (HIGH)
- Add issue templates and ADRs (MEDIUM)
- Add CONTRIBUTING.md, SECURITY.md (LOW)"

echo "Done! Run compliance checks again to verify."

---

Post-Fix Verification

After applying fixes, run the compliance checks again:

./run-all-checks.sh /path/to/.github --format markdown

---

_{Generated by Claude Code | Compliance Framework | 2026-01-19 09:28:40 UTC}

[labrats-ai-agents]

@ai-architect — Compliance Status Update

PR #22 fixed several compliance items (README.md, CLAUDE.md, .gitignore, docs/ directory). Here's what remains actionable:

Remaining fixable items — delegating to @ai-developer:

@ai-developer — Please fix the following compliance gaps in a single PR:

1. Fix deprecated action in .github/workflows/repo-info.yml

• Change actions/checkout@v3 → actions/checkout@v4
• Change runs-on: ubuntu-latest → runs-on: arc-runner-set (use ARC runner per org standards)

2. Add SECURITY.md to repo root

• Standard security policy: how to report vulnerabilities, supported versions
• Keep it concise

3. Add docs/adr/ directory with a placeholder ADR

• Create docs/adr/README.md explaining the ADR directory
• Create docs/adr/0001-use-arc-runners.md documenting the org decision to use ARC runners

4. Add .claude/ configuration directory

• Create .claude/settings.json with basic agent config (can be minimal {})

5. Add LICENSE file

• Use MIT license, copyright labrats-work

Not fixable by AI (requires admin):

• COMP-016: Branch protection on main — requires repo admin settings
• COMP-017: Repository settings (merge methods) — requires repo admin settings
• COMP-020: ARC runner usage — fixing in item 🔄 Workflow Health Report: 100% Success Rate (2025-12-03) #1 above

Standards

• Single PR with all changes
• Follow conventional commits: chore(compliance): fix remaining compliance gaps
• Assign PR to tomp736
• Close this issue when merged

[labrats-ai-agents]

❌ Architect (@ai-architect) — Failed

claude failed: File descriptor limits: soft=524288 hard=524288
Cloning repository (ref=main, depth=1)...
Cloning into '/workspace/repo'...
From https://github.com/labrats-work/.github

• branch main -> FETCH_HEAD
  Clone complete.
  {"type":"result","subtype":"success","is_error":true,"duration_ms":861,"duration_api_ms":0,"num_turns":1,"result":"Failed to authenticate. API Error: 401 {"type":"error","error":{"type":"authentication_error","message":"Invalid authentication credentials"

_{Job: 666}

[labrats-ai-agents]

⏳ Architect (@ai-architect) — In progress

_{Job: 666}

[labrats-ai-agents]

Architect Update — Compliance Remediation Plan

Many of the CRITICAL compliance failures have been resolved by PR #22 (merged), which added README.md, .gitignore, CLAUDE.md, and docs/.

Remaining Items for Remediation

@ai-developer please address the following in a single PR on branch fix/4-compliance-remaining:

Files to create:

• LICENSE — use MIT license, copyright labrats-work
• SECURITY.md — basic security reporting policy (report to maintainers via GitHub private disclosure)

Workflow fixes:

• .github/workflows/repo-info.yml — update actions/checkout@v3 → actions/checkout@v4
• workflow-templates/repo-info.yml — same fix

Note: CONTRIBUTING.md and .github/ISSUE_TEMPLATE/ are being created as part of #10. Once that PR merges, those compliance items will also be resolved.

After implementing, create a PR referencing this issue, assign to tomp736, and I'll review it.

Items that require manual/infra action (out of scope for code PRs):

• Branch protection settings — needs repo admin action
• ARC runner migration — infrastructure change, tracked separately
• docs/adr/ and mkdocs.yml — can be added later when ADR process is established

[labrats-ai-agents]

❌ Developer (@ai-developer) — Failed

claude failed: File descriptor limits: soft=524288 hard=524288
Cloning repository (ref=main, depth=1)...
Cloning into '/workspace/repo'...
From https://github.com/labrats-work/.github

• branch main -> FETCH_HEAD
  Clone complete.
  {"type":"result","subtype":"success","is_error":true,"duration_ms":844,"duration_api_ms":0,"num_turns":1,"result":"Failed to authenticate. API Error: 401 {"type":"error","error":{"type":"authentication_error","message":"Invalid authentication credentials"

_{Job: 715}

[labrats-ai-agents]

⏳ Developer (@ai-developer) — In progress

_{Job: 715}