chore: compliance gaps, security, and quality improvements#2
chore: compliance gaps, security, and quality improvements#2
Conversation
…/quality - Updated AGENTS.md and CLAUDE.md to latest rules via compose-agentsmd. - Added .tasks.jsonl with task-tracker. - Added CodeQL analysis and Dependabot for automated security and quality checks. - Added a tests/ directory with example good/bad plans to improve skill documentation and baseline verification. - Updated README.md to link to these examples.
|
Completed compliance and security improvements. Summary of Changes
|
There was a problem hiding this comment.
Pull request overview
This PR aims to close compliance gaps and improve baseline security/quality tooling by adding repo scanning automation and providing documented “good/bad” review-plan examples for skill verification.
Changes:
- Add CodeQL workflow and Dependabot configuration for automated security scanning.
- Add a committed task-tracker state file (
.tasks.jsonl) for cross-session task persistence. - Add a
tests/directory with example “good” and “bad” plans and link them from the main README.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
tests/examples/good-plan.md |
Adds an example “approved” plan and review output. |
tests/examples/bad-plan.md |
Adds an example “flagged” plan and review output. |
tests/README.md |
Documents how to use the examples for consistent reviews. |
README.md |
Links readers to the new tests/ examples. |
AGENTS.md |
Regenerated/updated rule composition with additional operational guidance. |
.tasks.jsonl |
Adds persisted task state for task-tracker. |
.github/workflows/codeql-analysis.yml |
Adds CodeQL scanning workflow. |
.github/dependabot.yml |
Adds Dependabot update configuration. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| See the [tests/](tests/) directory for examples of: | ||
|
|
||
| - **Good plans**: That meet all criteria and are APPROVED. | ||
| - **Bad plans**: That fail criteria (missing verification, known error patterns) and are FLAGed. |
There was a problem hiding this comment.
FLAGed is an awkward/incorrect inflection when referring to the decision label FLAG. Consider changing to FLAGGED (or flagged) for clearer English while still keeping the FLAG keyword recognizable.
| - **Bad plans**: That fail criteria (missing verification, known error patterns) and are FLAGed. | |
| - **Bad plans**: That fail criteria (missing verification, known error patterns) and are FLAGGED. |
| ## Structure | ||
|
|
||
| - `examples/good-plan.md`: A plan that meets all criteria and is APPROVED. | ||
| - `examples/bad-plan.md`: A plan that fails criteria (missing verification, known error patterns) and is FLAGed. |
There was a problem hiding this comment.
FLAGed is an awkward/incorrect inflection when referring to the decision label FLAG. Consider changing to FLAGGED (or flagged) for clearer English while still keeping the FLAG keyword recognizable.
| - `examples/bad-plan.md`: A plan that fails criteria (missing verification, known error patterns) and is FLAGed. | |
| - `examples/bad-plan.md`: A plan that fails criteria (missing verification, known error patterns) and is FLAGGED. |
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: [ 'javascript' ] |
There was a problem hiding this comment.
This repo currently contains no .js/.ts sources (only docs/config), so running CodeQL with language: javascript will likely produce no useful results (and may fail depending on CodeQL extraction). Consider switching to language: actions to analyze GitHub Actions workflows, or remove the workflow until there is a supported language to scan.
| language: [ 'javascript' ] | |
| language: [ 'actions' ] |
| - package-ecosystem: "npm" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" |
There was a problem hiding this comment.
Dependabot is configured for the npm ecosystem in /, but the repository doesn't currently have a package.json/lockfile. This will cause Dependabot runs to error. Either remove the npm entry, or add the expected npm manifests so Dependabot can operate.
| - package-ecosystem: "npm" | |
| directory: "/" | |
| schedule: | |
| interval: "weekly" |
| Source: github:metyatech/agent-rules@HEAD/rules/global/autonomous-operations.md | ||
|
|
||
| # Autonomous operations | ||
| # Autonomous operations |
There was a problem hiding this comment.
The heading on this line appears to include a leading Unicode BOM character (U+FEFF) before # (it renders as #). This can cause subtle diffs and tooling issues; please remove the BOM so the line starts with a plain #.
| # Autonomous operations | |
| # Autonomous operations |
|
Agent runner idle completed. Repo: metyatech/skill-user-proxy Summary: |
This PR addresses several compliance gaps and improves the repository's security and quality standards.
Changes
Verification