feat(ci): Phase 1-2 — label automation + CodeQL security scanning by mpaulosky · Pull Request #8 · mpaulosky/MyBlog

mpaulosky · 2026-04-18T19:57:00Z

Working as Boromir (DevOps)

Summary

Adds three missing GitHub Actions workflows to complete Phase 1-2 of the CI/CD roadmap.

Workflows Added

`squad-pr-auto-label.yml`

Automatically labels new PRs when they're opened, reopened, or synchronized:

Routes dependabot / renovate / github-actions bot PRs directly to squad:boromir + squad with an explanatory comment
Labels all other PRs with squad (triage queue) and prompts the lead to assign a member

`squad-label-enforce.yml`

Enforces mutual exclusivity on managed label namespaces whenever a label is applied to an issue:

go: — only one triage verdict at a time; auto-applies release:backlog on go:yes, strips release labels on go:no
release: — only one release target at a time
type: — only one issue type at a time
priority: — only one priority at a time
Posts a comment whenever a label is replaced so the change is visible in the thread

`codeql-analysis.yml`

Security scanning via GitHub CodeQL:

Triggers on push to main/dev (.cs/.csproj changes), all PRs, weekly schedule (Fridays 00:31 UTC), and workflow_dispatch
Uses codeql-action@v3, actions/checkout@v4, actions/setup-dotnet@v4 with .NET 10 preview
CI: true env var set to skip any interactive build steps during autobuild
Adapted from IssueTrackerApp: removed Auth0/MongoDB env vars, removed workflow_dispatch inputs block

What's Next

Phase 3 — Parallel test matrix (unit / integration / architecture tests in separate jobs)
Phase 4 — Dev branch workflows (feature branch CI, preview deployments)

No issue to close — tracks internal CI/CD hardening plan.

- Merge decision inbox file into .squad/decisions.md with: - CI workflow security review (PR #5) - Template cleanup security review (PR #6) - Copyright header decision (PR #7) - Delete gandalf-pr5-pr6-merged.md from decisions/inbox/ - Add orchestration log with full PR merge details - Add session log summarizing board clear status PRs #5 (CI workflow), #6 (template cleanup), #7 (copyright headers) all merged to main by Gandalf. All 74 tests passing, 91.64% coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- squad-pr-auto-label.yml: auto-labels new PRs with squad triage labels and routes dependabot PRs to Boromir - squad-label-enforce.yml: enforces mutual exclusivity on go:, release:, type:, and priority: label namespaces - codeql-analysis.yml: weekly + push/PR security scanning, adapted from IssueTrackerApp (removed Auth0/MongoDB secrets, added CI=true env var, updated to .NET 10 preview setup, uses codeql-action v3) Working as Boromir (DevOps) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-04-18T19:58:17Z

Package	Line Rate	Branch Rate	Complexity	Health
Domain	0%	0%	38	❌
Web	0%	0%	320	❌
ServiceDefaults	0%	0%	18	❌
Domain	0%	0%	38	❌
Web	0%	0%	320	❌
ServiceDefaults	0%	0%	18	❌
AppHost	0%	100%	1	❌
Domain	43%	0%	38	❌
Web	6%	5%	320	❌
ServiceDefaults	0%	0%	18	❌
AppHost	0%	100%	1	❌
Domain	43%	0%	38	❌
Web	6%	5%	320	❌
ServiceDefaults	0%	0%	18	❌
Domain	93%	50%	38	✔
Web	63%	64%	320	➖
ServiceDefaults	0%	0%	18	❌
Domain	93%	50%	38	✔
Web	63%	64%	320	➖
ServiceDefaults	0%	0%	18	❌
Summary	23% (974 / 4226)	21% (336 / 1584)	2258	❌

github-advanced-security · 2026-04-18T19:59:53Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

Copilot

Pull request overview

Adds Phase 1–2 CI/CD automation workflows to streamline PR triage/label governance and introduce CodeQL security scanning for the .NET codebase.

Changes:

Add PR auto-labeling workflow for initial squad triage + bot routing.
Add label namespace exclusivity enforcement workflow for issues.
Add CodeQL analysis workflow for C# on PRs, selected pushes, and a weekly schedule.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`.github/workflows/squad-pr-auto-label.yml`	Auto-applies `squad` / `squad:*` labels on new PRs and posts an informational comment.
`.github/workflows/squad-label-enforce.yml`	Enforces mutual exclusivity within `go:`, `release:`, `type:`, `priority:` label namespaces.
`.github/workflows/codeql-analysis.yml`	Runs GitHub CodeQL scanning for C# with scheduled and PR triggers.
`.squad/decisions.md`	Records decisions for prior CI/template-related PRs in the squad decision log.
`.squad/agents/gandalf/history.md`	Adds Gandalf’s security review notes/history for related PRs.

Copilot · 2026-04-18T20:00:05Z

+    types: [opened, reopened, synchronize]
+
+permissions:
+  pull-requests: write


The workflow uses github.rest.issues.* APIs to list/add labels and create a comment on the PR, but the workflow-level permissions block does not grant issues: write (or issues: read). With only pull-requests: write, these calls can fail with permission errors. Add issues: write to the permissions (and consider dropping pull-requests: write if it's not otherwise needed).

Suggested change

pull-requests: write

pull-requests: write

issues: write

Decisions: - Merged roadmap validation findings (Aragorn architectural, Boromir operational) - Deleted .squad/decisions/inbox/* (merged to decisions.md #8) - Added execution constraints for M1 implementation Logs: - .squad/orchestration-log/2026-04-19T02:47:33Z-aragorn.md - .squad/orchestration-log/2026-04-19T02:47:33Z-boromir.md - .squad/log/2026-04-19T02:47:33Z-roadmap-rubberduck.md History: - Updated aragorn and boromir history.md with Sprint 0 findings Decision #8: Roadmap approved with 5 refinements + 3 constraints. Milestone 1 ready. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add explicit hard gate to routing.md, sprint-planning.md, and pr-merge-process.md so no agent can start coding without a GitHub issue linked to a milestone. Changes: - routing.md: guardrail #1 (absolute pre-code issue check) and guardrail #8 (direct user request gate): any coding request triggers an issue existence check first - sprint-planning.md: new 'Hard Gate — No Code Before Issue' section with enforcement sequence; two new anti-pattern entries covering no-issue code and plan-without-ceremony patterns - pr-merge-process.md: Ralph's Pre-Review Gate table now includes 'GitHub issue exists' check (Closes #N required); new anti-pattern for PRs missing issue link Closes #50 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

## Summary Closes #50 Adds an explicit **"no code before issue"** hard gate to prevent future process violations where implementation starts before a GitHub issue is created. ## Changes ### `routing.md` - **Guardrail #1** (new): Absolute pre-code issue check — any work must have an existing GitHub issue before any file is touched - **Guardrail #8** (new): Direct user coding requests trigger the same issue-first check ### `sprint-planning.md` - **New section: Hard Gate — No Code Before Issue** — enforcement sequence with explicit YES/NO decision tree - **Anti-patterns**: Added `❌ Writing any code before a GitHub issue exists` and `❌ Implementing a [[PLAN]] request without running the sprint planning ceremony` ### `pr-merge-process.md` - **Ralph's Pre-Review Gate**: Added `GitHub issue exists` row — PR body must contain `Closes #N`; if missing, Ralph creates the issue before review proceeds - **Anti-patterns**: Added `❌ Opening a PR without a Closes #N link` ## Testing This is a documentation/process change. No code was modified; no build/test verification needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- sprint-planning.md: rename Hard Gate to 'No Code Before Issue / No Issue Without Sprint'; add explicit sprint-stamp check (title prefix + milestone + board); add two new anti-patterns for missing prefix and milestone; strengthen Step 3 with must-have callout - routing.md: update Guardrails #1 and #8 to require [Sprint N] title prefix and milestone in addition to issue existence - issue-lifecycle.md: add Mandatory Issue Format section with canonical create command and three-requirement table No issue may be created, branched, or PR'd without [Sprint N] title and milestone set to Sprint N: {Theme}. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- sprint-planning.md: strengthen Hard Gate to require [Sprint N] title prefix and milestone before any branch; add 2 new anti-patterns - sprint-planning.md: Step 3 gains mandatory-format table - routing.md: Guardrails #1 and #8 require milestone + sprint prefix on every issue - issue-lifecycle.md: add mandatory issue format block to GitHub section Closes #66 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Closes #66 Working as Ralph (Meta / squad maintenance) ## Summary Strengthens three squad process documents so that no issue can exist without a sprint assignment and every issue title carries the `[Sprint N]` prefix. ## Changes - **`sprint-planning.md`** — Hard Gate updated to require `[Sprint N]` title prefix + milestone before any branch; Step 3 gains a mandatory-format table; two new anti-patterns added - **`routing.md`** — Guardrails #1 and #8 updated to require both milestone and sprint prefix on every issue before code starts - **`issue-lifecycle.md`** — Mandatory issue format block added to GitHub section (title pattern + milestone field rules) ## Testing Squad process documents — no build or test suite applies. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Closes milestone: Sprint 7 — xUnit v3 Pilot (Domain.Tests) ## Sprint Summary - ✅ Added xUnit v3 packages (v3.2.2) to Directory.Packages.props alongside xUnit v2 - ✅ Domain.Tests migrated to xUnit v3: 42/42 tests passing - ✅ Zero source-level breaking changes required - ✅ CI validation complete — xUnit v3 fully compatible - ✅ ADR recorded with performance analysis (5–15% improvement projected) - ✅ Retrospective template prepared for Phase 2 validation ## Issues Closed - Closes #162 - Closes #163 - Closes #164 - Closes #165 - Closes #166 - Closes #167 ## Checklist - [x] All sprint issues closed - [x] CI green - [x] Milestone at 100% - [x] All PRs merged to sprint branch --------- Co-authored-by: Boromir <boromir@squad.dev> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

mpaulosky and others added 2 commits April 18, 2026 12:24

Copilot AI review requested due to automatic review settings April 18, 2026 19:57

Copilot started reviewing on behalf of mpaulosky April 18, 2026 19:57 View session

Copilot AI reviewed Apr 18, 2026

View reviewed changes

mpaulosky enabled auto-merge (squash) April 18, 2026 20:07

mpaulosky merged commit b722a82 into main Apr 18, 2026
8 checks passed

mpaulosky deleted the squad/cicd-phase1-2-workflows branch April 18, 2026 20:42

mpaulosky mentioned this pull request Apr 19, 2026

Harden plan workflow: no-code-before-issue gate #50

Closed

5 tasks

mpaulosky mentioned this pull request Apr 19, 2026

chore: harden plan workflow — no-code-before-issue gate #51

Merged

mpaulosky mentioned this pull request Apr 19, 2026

[Sprint 3] Enforce sprint context on all issue creation #66

Closed

6 tasks

mpaulosky mentioned this pull request Apr 19, 2026

docs(squad): enforce sprint context on all issue creation (#66) #67

Merged

This was referenced Apr 24, 2026

docs: add Review PR shorthand command to Squad Commands reference #133

Closed

docs: add Review PR shorthand command to Squad Commands (#133) #134

Merged

Copilot AI mentioned this pull request Apr 24, 2026

chore: promote dev → main — Review PR shorthand doc update #136

Merged

2 tasks

mpaulosky mentioned this pull request May 15, 2026

[Sprint 19] Polish category UX, test naming, and documentation #342

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ci): Phase 1-2 — label automation + CodeQL security scanning#8

feat(ci): Phase 1-2 — label automation + CodeQL security scanning#8
mpaulosky merged 2 commits into
mainfrom
squad/cicd-phase1-2-workflows

mpaulosky commented Apr 18, 2026

Uh oh!

github-actions Bot commented Apr 18, 2026

Uh oh!

github-advanced-security AI commented Apr 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mpaulosky commented Apr 18, 2026

Summary

Workflows Added

squad-pr-auto-label.yml

squad-label-enforce.yml

codeql-analysis.yml

What's Next

Uh oh!

github-actions Bot commented Apr 18, 2026

Uh oh!

github-advanced-security AI commented Apr 18, 2026

What Enabling Code Scanning Means:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

`squad-pr-auto-label.yml`

`squad-label-enforce.yml`

`codeql-analysis.yml`